Vulnerability intelligence

CVE-2025-15039

WSO2 WSO2 Identity Server CWE-693

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account.

CVSS Score

9.4

Critical

EPSS — Exploit Probability

0.4%

Riskier than 34% of all CVEs · checked 2026-09-19

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories