CVE-2025-9973: WSO2 Identity Server Auth Bypass Flaw

CVE-2025-9973 Overview

CVE-2025-9973 is a broken access control vulnerability [CWE-284] in WSO2 Identity Server. The flaw stems from missing organization context validation when executing adaptive authentication flows. A malicious actor with privileges to configure adaptive authentication in one organization can trigger authentication logic against other organizations and sub-organizations. The vulnerability enables bypassing authorization boundaries in multi-organization deployments, leading to unauthorized access to critical operations and user accounts. Exploitation requires high privileges within an organization and adjacent network access to the Identity Server.

Critical Impact

Authenticated administrators in one tenant can execute adaptive authentication logic against unintended organizations, enabling cross-tenant privilege escalation and potential account takeover.

Affected Products

• WSO2 Identity Server (multi-organization deployments with adaptive authentication enabled)
• Refer to WSO2 Security Advisory WSO2-2025-4530 for affected version ranges

Discovery Timeline

• 2026-05-11 - CVE-2025-9973 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-9973

Vulnerability Analysis

WSO2 Identity Server supports adaptive authentication, where administrators define authentication logic using scripts evaluated during login flows. In multi-organization deployments, each organization maintains independent administrative boundaries. The product fails to validate the organization context when executing these adaptive authentication scripts. As a result, logic configured in one organization can be triggered against users and resources in other organizations or sub-organizations.

The vulnerability falls under improper access control [CWE-284]. It does not require a remote unauthenticated attacker. The threat actor must already possess privileges to configure adaptive authentication scripts within at least one organization. Once that condition is met, the actor can pivot across tenant boundaries that the multi-organization model is designed to enforce.

Root Cause

The Identity Server executes adaptive authentication logic without binding the execution to the organization that owns the script. Authorization checks verify the configuring user's rights within their own organization but do not constrain which organization the resulting authentication flow can target. This decoupling between script ownership and execution context allows authentication logic to influence flows in unrelated tenants.

Attack Vector

An authenticated administrator configures adaptive authentication in a controlled organization. The administrator crafts script logic that performs privileged operations, such as user lookups, claim modifications, or step-up authentication decisions. When the script executes, it operates against organizations the attacker should not control. The outcome includes privilege escalation, unauthorized access to resources, and account takeover across organizational boundaries.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the WSO2 Security Advisory WSO2-2025-4530.

Detection Methods for CVE-2025-9973

Indicators of Compromise

• Adaptive authentication script executions logged against organizations that do not own the configured script
• Authentication events for users in one organization correlated with administrative actions sourced from another organization
• Unexpected claim modifications, role assignments, or session establishments in sub-organizations

Detection Strategies

• Audit WSO2 Identity Server logs for adaptive authentication script invocations and compare the script owner organization against the target organization in each authentication event
• Review recent changes to adaptive authentication scripts across all organizations, focusing on logic that calls cross-tenant APIs or references identifiers outside the configuring tenant
• Correlate administrator activity in lower-trust organizations with authentication anomalies in higher-trust organizations

Monitoring Recommendations

• Forward Identity Server audit logs and authentication logs to a centralized SIEM for cross-organization correlation
• Alert on adaptive authentication configuration changes performed by accounts that do not normally administer scripts
• Track failed and successful authentications grouped by organization to surface anomalous cross-tenant access patterns

How to Mitigate CVE-2025-9973

Immediate Actions Required

• Apply the vendor-supplied fix referenced in WSO2 Security Advisory WSO2-2025-4530
• Inventory all organizations where adaptive authentication is enabled and review each script for cross-tenant references
• Restrict the set of administrators able to configure adaptive authentication scripts to a minimal, audited group

Patch Information

WSO2 published security advisory WSO2-2025-4530 covering CVE-2025-9973. Administrators should consult the advisory for fixed versions, WUM updates, and any required configuration steps. Apply patches in non-production environments first and validate authentication flows for each organization before promoting changes.

Workarounds

• Disable adaptive authentication in multi-organization deployments until the patch is applied
• Remove or quarantine adaptive authentication scripts that are not strictly required for production logins
• Tighten role assignments so that only highly trusted operators retain privileges to create or modify adaptive authentication logic
• Segment network access to the Identity Server management interfaces to reduce exposure consistent with the adjacent-network attack vector