Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
At a glance
Severity
CRITICAL 9.4
EPSS
EPSS 0.67 % · percentile 52 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
WSO2
NVD status
Analyzed
Description
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.
Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
