Description
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected products
- WSO2 / api_control_plane4.5.0 – 4.5.0.45
- WSO2 / api_manager2.6.0 – 2.6.0.150
- WSO2 / Identity Server5.7.0 – 5.7.0.130
- WSO2 / identity_server_as_key_manager5.7.0 – 5.7.0.129
- WSO2 / open_banking_am1.4.0 – 1.4.0.143
- WSO2 / open_banking_iam2.0.0 – 2.0.0.425
- WSO2 / open_banking_km1.4.0 – 1.4.0.137
- WSO2 / traffic_manager4.5.0 – 4.5.0.43
- WSO2 / universal_gateway4.5.0 – 4.5.0.44
- WSO2 / WSO2 API Control Plane4.6.0 – 4.6.0.9
- WSO2 / WSO2 API Control Plane4.5.0 – 4.5.0.45
- WSO2 / WSO2 API Manager4.4.0 – 4.4.0.59
- WSO2 / WSO2 API Manager4.6.0 – 4.6.0.8
- WSO2 / WSO2 API Manager4.5.0 – 4.5.0.44
- WSO2 / WSO2 API Manager0 – 2.6.0
- WSO2 / WSO2 API Manager2.6.0 – 2.6.0.150
- WSO2 / WSO2 API Manager3.0.0 – 3.0.0.180
- WSO2 / WSO2 API Manager3.1.0 – 3.1.0.356
- WSO2 / WSO2 API Manager3.2.0 – 3.2.0.460
- WSO2 / WSO2 API Manager3.2.1 – 3.2.1.79
- WSO2 / WSO2 API Manager4.0.0 – 4.0.0.381
- WSO2 / WSO2 API Manager4.1.0 – 4.1.0.244
- WSO2 / WSO2 API Manager4.2.0 – 4.2.0.184
- WSO2 / WSO2 API Manager4.3.0 – 4.3.0.95
- WSO2 / WSO2 Carbon Identity Application Authentication Framework7.8.646 – *
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.12.153 – 5.12.153.66
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.12.387 – 5.12.387.48
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.14.97 – 5.14.97.94
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.17.5 – 5.17.5.337
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.17.118 – 5.17.118.24
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.18.187 – 5.18.187.334
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.18.248 – 5.18.248.34
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.23.8 – 5.23.8.221
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.24.8 – 5.24.8.29
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.25.92 – 5.25.92.177
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.25.705 – 5.25.705.23
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.25.713 – 5.25.713.12
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.25.724 – 5.25.724.8
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.25.736 – 5.25.736.3
- WSO2 / WSO2 Carbon Identity Application Authentication Framework7.0.78 – 7.0.78.171
- WSO2 / WSO2 Carbon Identity Application Authentication Framework7.8.23 – 7.8.23.95
- WSO2 / WSO2 Carbon Identity Application Authentication Framework7.8.586 – 7.8.586.21
- WSO2 / WSO2 Carbon Identity Application Authentication Framework5.25.738 – 5.25.*
- WSO2 / WSO2 Identity Server7.0.0 – 7.0.0.138
- WSO2 / WSO2 Identity Server5.8.0 – 5.8.0.113
- WSO2 / WSO2 Identity Server5.7.0 – 5.7.0.130
- WSO2 / WSO2 Identity Server0 – 5.7.0
- WSO2 / WSO2 Identity Server7.1.0 – 7.1.0.45
- WSO2 / WSO2 Identity Server7.1.0 – 7.1.0.49
- WSO2 / WSO2 Identity Server7.2.0 – 7.2.0.7
- WSO2 / WSO2 Identity Server6.1.0 – 6.1.0.260
- WSO2 / WSO2 Identity Server6.0.0 – 6.0.0.259
- WSO2 / WSO2 Identity Server5.11.0 – 5.11.0.432
- WSO2 / WSO2 Identity Server5.10.0 – 5.10.0.385
- WSO2 / WSO2 Identity Server5.9.0 – 5.9.0.173
- WSO2 / WSO2 Identity Server as Key Manager0 – 5.7.0
- WSO2 / WSO2 Identity Server as Key Manager5.9.0 – 5.9.0.179
- WSO2 / WSO2 Identity Server as Key Manager5.7.0 – 5.7.0.129
- WSO2 / WSO2 Identity Server as Key Manager5.10.0 – 5.10.0.376
- WSO2 / WSO2 Open Banking AM1.5.0 – 1.5.0.144
- WSO2 / WSO2 Open Banking AM0 – 1.4.0
- WSO2 / WSO2 Open Banking AM1.4.0 – 1.4.0.143
- WSO2 / WSO2 Open Banking AM2.0.0 – 2.0.0.405
- WSO2 / WSO2 Open Banking IAM2.0.0 – 2.0.0.425
- WSO2 / WSO2 Open Banking IAM0 – 2.0.0
- WSO2 / WSO2 Open Banking KM1.4.0 – 1.4.0.137
- WSO2 / WSO2 Open Banking KM1.5.0 – 1.5.0.127
- WSO2 / WSO2 Open Banking KM0 – 1.4.0
- WSO2 / WSO2 Traffic Manager0 – 4.5.0
- WSO2 / WSO2 Traffic Manager4.6.0 – 4.6.0.8
- WSO2 / WSO2 Traffic Manager4.5.0 – 4.5.0.43
- WSO2 / WSO2 Universal Gateway4.6.0 – 4.6.0.8
- WSO2 / WSO2 Universal Gateway4.5.0 – 4.5.0.44
- WSO2 / WSO2 Universal Gateway4.5.0 – 4.5.0.43
Updated 16m ago · 8 sources