Description
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WSO2 WSO2 Identity Server
Default version status: unaffected
0 to < 5.7.0unknown5.7.0 to < 5.7.0.130affected5.8.0 to < 5.8.0.113affected5.9.0 to < 5.9.0.173affected5.10.0 to < 5.10.0.385affected5.11.0 to < 5.11.0.432affected6.0.0 to < 6.0.0.259affected6.1.0 to < 6.1.0.260affected7.0.0 to < 7.0.0.138affected7.1.0 to < 7.1.0.45affected7.1.0 to < 7.1.0.49affected7.2.0 to < 7.2.0.7affected
WSO2 WSO2 API Manager
Default version status: unaffected
0 to < 2.6.0unknown2.6.0 to < 2.6.0.150affected3.0.0 to < 3.0.0.180affected3.1.0 to < 3.1.0.356affected3.2.0 to < 3.2.0.460affected3.2.1 to < 3.2.1.79affected4.0.0 to < 4.0.0.381affected4.1.0 to < 4.1.0.244affected4.2.0 to < 4.2.0.184affected4.3.0 to < 4.3.0.95affected4.4.0 to < 4.4.0.59affected4.5.0 to < 4.5.0.44affected4.6.0 to < 4.6.0.8affected
WSO2 WSO2 Open Banking AM
Default version status: unaffected
0 to < 1.4.0unknown1.4.0 to < 1.4.0.143affected1.5.0 to < 1.5.0.144affected2.0.0 to < 2.0.0.405affected
WSO2 WSO2 Open Banking IAM
Default version status: unaffected
0 to < 2.0.0unknown2.0.0 to < 2.0.0.425affected
WSO2 WSO2 Traffic Manager
Default version status: unaffected
0 to < 4.5.0unknown4.5.0 to < 4.5.0.43affected4.6.0 to < 4.6.0.8affected
WSO2 WSO2 Universal Gateway
Default version status: unaffected
4.5.0 to < 4.5.0.43affected4.5.0 to < 4.5.0.44affected4.6.0 to < 4.6.0.8affected
WSO2 WSO2 API Control Plane
Default version status: unaffected
4.5.0 to < 4.5.0.45affected4.6.0 to < 4.6.0.9affected
WSO2 WSO2 Identity Server as Key Manager
Default version status: unaffected
0 to < 5.7.0unknown5.7.0 to < 5.7.0.129affected5.9.0 to < 5.9.0.179affected5.10.0 to < 5.10.0.376affected
WSO2 WSO2 Open Banking KM
Default version status: unaffected
0 to < 1.4.0unknown1.4.0 to < 1.4.0.137affected1.5.0 to < 1.5.0.127affected
WSO2 WSO2 Carbon Identity Application Authentication Framework
Default version status: unknown
5.12.153 to < 5.12.153.66affected5.12.387 to < 5.12.387.48affected5.14.97 to < 5.14.97.94affected5.17.5 to < 5.17.5.337affected5.17.118 to < 5.17.118.24affected5.18.187 to < 5.18.187.334affected5.18.248 to < 5.18.248.34affected5.23.8 to < 5.23.8.221affected5.24.8 to < 5.24.8.29affected5.25.92 to < 5.25.92.177affected5.25.705 to < 5.25.705.23affected5.25.713 to < 5.25.713.12affected5.25.724 to < 5.25.724.8affected5.25.736 to < 5.25.736.3affected7.0.78 to < 7.0.78.171affected7.8.23 to < 7.8.23.95affected7.8.586 to < 7.8.586.21affected5.25.738 to ≤ 5.25.*unaffected7.8.646 to ≤ *unaffected