Cross-Tenant Authentication Vulnerability in WSO2 Products

CVE-2025-0663

What is CVE-2025-0663?

A cross-tenant authentication vulnerability has been identified in multiple WSO2 products due to inadequate cryptographic design in the Adaptive Authentication feature. Specifically, a single cryptographic key is utilized across all tenants for signing authentication cookies, which can allow a user with elevated privileges in one tenant to fabricate authentication cookies, thereby gaining unauthorized access to user accounts in other tenants. The issue is exacerbated by the fact that the Auto-Login feature is enabled by default, increasing the risk of account takeovers. While successful exploitation requires access to Adaptive Authentication capabilities—typically restricted to high-privilege users—the actual impact of this flaw diminishes in environments where Auto-Login has been disabled.

References