Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations
Why It Matters
Analysis dossierWhy It Matters
Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations.
High
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; HIGH severity; No confirmed exploitation signal in current enrichment
Affected Products & Remediation
1 source-backed product- wso2 identity server · >= 7.1.0 < 7.1.0.26 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched authorization-bypass (CWE-863)
Exposure
- Locate affected authorization controls and verify deployed versions.Telemetry: Application inventory · The source must identify the affected control. · Rule authorization-bypass
Exploitation evidence
- Review privileged operations performed by unexpected users on affected deployments.Telemetry: Application audit logs · Authorization anomalies can support a targeted hunt. · Rule authorization-bypass
Response
- Confirm the vendor mitigation and recheck access decisions.Telemetry: Application audit logs · Access testing verifies the local fix. · Rule authorization-bypass
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- ed10eef1-636d-4fbe-9993-6890dfa878f8
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2025-9973"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descCorrelated briefings
— No published briefing references this CVE