CVE-2025-9973
📛 CVE Title
Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
Description
Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WSO2
- CVSS severity
- MEDIUM
- CVSS score
- 6.4 / 10
- CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L- Effective score
- 6.4 / 10 MEDIUM source: CNA overview
- CWE(s)
- —
- Reserved
- 2025-09-04
- Published
- 2026-05-11 12:12 UTC
- Last updated
- 2026-05-11 17:18 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/9xxx/CVE-2025-9973.json
- Linked Threat
- CVE-2025-9973 — CVE-2025-9973
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-11 12:16:11 UTC
- NVD last modified
- 2026-05-13 15:25:04 UTC
- NVD CVSS v3.1
- 6.4 / 10 MEDIUM source: ed10eef1-636d-4fbe-9993-6890dfa878f8
- NVD CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L- Exploitability subscore
- 0.9 / 10
- Impact subscore
- 5.5 / 10
- EPSS score
- 0.0003 (probability of exploitation in next 30 days)
- EPSS percentile
- 7.74% vs all CVEs — higher = more likely to be exploited, as of 2026-05-25
NVD-assigned CWE(s):
CWE-284,
CWE-863
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 20:37 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2025-209762 - Assigner
- WSO2
- Published
- May 11, 2026, 10:12:39 AM
- Updated
- May 11, 2026, 3:18:59 PM
- EUVD base score (CVSS 3.1)
-
6.4 / 10
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - EUVD-reported EPSS
- 0.0700
- Vendors
- WSO2
- Products
-
Conditional Authentication User and Roles Related FunctionsWSO2 Identity Server (7.1.0 <7.1.0.26)Conditional Authentication User and Roles Related Functions (1.2.76 <1.2.76.1)
ENISA description: Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| WSO2 | WSO2 Identity Server |
7.1.0 (affected)
|
— |
| WSO2 | Conditional Authentication User and Roles Related Functions |
1.2.76 (affected),
1.2.82 (unaffected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (3)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2025-9973 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2025-9973 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530/ ed10eef1-636d-4fbe-9993-6890dfa878f8
Remediations (17)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:cybersecuritynews.com
Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2.
2026-05-23 21:02 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-23 21:02 UTC -
web:securitricks.com
CVE CVE-2025-9973 - Score : 6.4 - Source : ed10eef1-636d-4fbe-9993-6890dfa878f8 - Description : Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can ...
2026-05-23 21:02 UTC -
web:securityvulnerability.io
What is CVE-2025-9973 ? The WSO2 Identity Server is exposed to a vulnerability that arises from the improper validation of organization context during adaptive authentication flows. This flaw enables a malicious actor with configuration privileges to exploit adaptive authentication features intended for their own organization, potentially executing unauthorized authentication actions across ...
2026-05-23 21:02 UTC -
web:www.bleepingcomputer.com
Microsoft has released out-of-band (OOB) security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with publicly available proof-of-concept exploit code.
2026-05-23 21:02 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-23 21:02 UTC -
web:www.maketecheasier.com
Check out the latest Windows 11 and Windows 10 update problems and their solutions, as recommended by Microsoft experts.
2026-05-23 21:02 UTC -
web:www.ninjaone.com
Catalog of Microsoft KB updates with insights on performance & user sentiment. Find out what's working, what's not, & make informed decisions.
2026-05-23 21:02 UTC -
web:www.oracle.com
This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.
2026-05-23 21:02 UTC -
web:www.windowslatest.com
Windows 11 March 2026 Patch Tuesday update adds Emoji 16.0, Sysmon, network speed test, reliability improvements, and security fixes.
2026-05-23 21:02 UTC -
web:cyberpress.org
Microsoft has rolled out a new cumulative update, KB5089573, for Windows 11 versions 25H2 and 24H2, directly addressing the frustrating installation failures that plagued users during May's Patch Tuesday cycle.
2026-06-03 22:32 UTC -
web:krebsonsecurity.com
Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited ...
2026-06-03 22:32 UTC -
web:thewincentral.com
Microsoft has released the new optional Windows 11 preview update KB5089573 for versions 24H2 and 25H2, bringing systems to OS Builds 26100.8524 and 26200.8524. While this is technically a preview cumulative update ahead of June 2026 Patch Tuesday, it includes several meaningful upgrades focused on performance, AI hardware monitoring, audio sharing, Windows Hello responsiveness, and webcam ...
2026-06-03 22:32 UTC -
web:www.bleepingcomputer.com
Microsoft has released Windows 11 KB5079473 and KB5078883 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features.
2026-06-03 22:32 UTC -
web:www.lansweeper.com
The October 2025 edition of Patch Tuesday brings us 173 new fixes, with 9 rated as critical, 3 of which are actively exploited. We've listed the most important changes below. Windows Agere Modem Driver Elevation of Privilege Vulnerability CVE - 2025 -24990 is an elevation of privilege vulnerability that has been actively exploited.
2026-06-03 22:32 UTC -
web:www.windowscentral.com
Microsoft's March Patch Tuesday updates are rolling out on Windows 11, and this month there's some actually good improvements coming to enhance your PC.
2026-06-03 22:32 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-06-03 22:32 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2025-9973.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9973",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:18:34.283042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:18:59.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "7.1.0.26",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.conditional.auth.functions:org.wso2.carbon.identity.conditional.auth.functions.user",
"product": "Conditional Authentication User and Roles Related Functions",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.2.76.1",
"status": "affected",
"version": "1.2.76",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.2.82",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.26",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:conditional_authentication_user_and_roles_related_functions:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.76.1",
"versionStartIncluding": "1.2.76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:conditional_authentication_user_and_roles_related_functions:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "1.2.82",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations.\n\nThis flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations."
}
],
"value": "Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations.\n\nThis flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations."
}
],
"impacts": [
{
"capecId": "CAPEC-601",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-601 CAPEC-601: Access Control"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T10:12:39.547Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530/#solution</span></a> <br>"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4530",
"discovery": "INTERNAL"
},
"title": "Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-9973",
"datePublished": "2026-05-11T10:12:39.547Z",
"dateReserved": "2025-09-04T08:21:53.892Z",
"dateUpdated": "2026-05-11T15:18:59.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}