CVE-2025-9973
Authentication Bypass in WSO2 Identity Server via Adaptive Flow
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | identity_server | 7.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9973 is a medium-severity vulnerability in WSO2 Identity Server version 7.1.0 that arises from improper validation of the organization context during adaptive authentication flows.
This flaw allows a malicious actor who has privileges to configure adaptive authentication in one organization to trigger authentication logic on other organizations and sub-organizations, bypassing authorization boundaries.
As a result, unauthorized access to critical operations and user accounts across organizations can occur, potentially leading to privilege escalation and account takeover.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to critical operations and user accounts in organizations other than the one the attacker has privileges in.
It enables privilege escalation and potential account takeover across multiple organizations in a multi-organization deployment.
Such unauthorized access can compromise sensitive resources and disrupt normal operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in WSO2 Identity Server (CVE-2025-9973), users should apply the provided fix from the official GitHub repository or upgrade to the latest unaffected version.
WSO2 Support Subscription Holders are advised to update to the specified version or higher to address the issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized access to critical operations and user accounts across organizations by bypassing authorization boundaries. Such unauthorized access and potential account takeover could lead to violations of data protection and privacy requirements mandated by standards like GDPR and HIPAA.
Specifically, the flaw may result in privilege escalation and unauthorized resource access, which can compromise the confidentiality and integrity of personal and sensitive data. This undermines compliance with regulations that require strict access controls and protection of user data.
Therefore, organizations using affected versions of WSO2 Identity Server in multi-organization deployments should promptly apply fixes or upgrade to mitigate risks that could lead to non-compliance with such standards.