Conditional Authentication Bypass in WSO2 Product

CVE-2025-15039

What is CVE-2025-15039?

A vulnerability exists in WSO2 Identity Server's Conditional Authentication mechanism, which fails to properly enforce all required authentication steps. This misconfiguration allows attackers to bypass intermediate authentication challenges when a certain multi-step pattern and specific event callbacks are involved. As a result, a malicious actor could potentially gain unauthorized access to user accounts by successfully navigating through the required preceding authentication steps, given that the targeted user has an affected authenticator enrolled.

References