Description (CNA)
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 Identity Server | unknown 0 before 5.7.0; affected 5.7.0 before 5.7.0.130; affected 5.8.0 before 5.8.0.113; affected 5.9.0 before 5.9.0.173; affected 5.10.0 before 5.10.0.385; affected 5.11.0 before 5.11.0.432; affected 6.0.0 before 6.0.0.259; affected 6.1.0 before 6.1.0.260; affected 7.0.0 before 7.0.0.138; affected 7.1.0 before 7.1.0.45; affected 7.1.0 before 7.1.0.49; affected 7.2.0 before 7.2.0.7 |
| WSO2 / WSO2 API Manager | unknown 0 before 2.6.0; affected 2.6.0 before 2.6.0.150; affected 3.0.0 before 3.0.0.180; affected 3.1.0 before 3.1.0.356; affected 3.2.0 before 3.2.0.460; affected 3.2.1 before 3.2.1.79; affected 4.0.0 before 4.0.0.381; affected 4.1.0 before 4.1.0.244; affected 4.2.0 before 4.2.0.184; affected 4.3.0 before 4.3.0.95; affected 4.4.0 before 4.4.0.59; affected 4.5.0 before 4.5.0.44; affected 4.6.0 before 4.6.0.8 |
| WSO2 / WSO2 Open Banking AM | unknown 0 before 1.4.0; affected 1.4.0 before 1.4.0.143; affected 1.5.0 before 1.5.0.144; affected 2.0.0 before 2.0.0.405 |
| WSO2 / WSO2 Open Banking IAM | unknown 0 before 2.0.0; affected 2.0.0 before 2.0.0.425 |
| WSO2 / WSO2 Traffic Manager | unknown 0 before 4.5.0; affected 4.5.0 before 4.5.0.43; affected 4.6.0 before 4.6.0.8 |
| WSO2 / WSO2 Universal Gateway | affected 4.5.0 before 4.5.0.43; affected 4.5.0 before 4.5.0.44; affected 4.6.0 before 4.6.0.8 |
| WSO2 / WSO2 API Control Plane | affected 4.5.0 before 4.5.0.45; affected 4.6.0 before 4.6.0.9 |
| WSO2 / WSO2 Identity Server as Key Manager | unknown 0 before 5.7.0; affected 5.7.0 before 5.7.0.129; affected 5.9.0 before 5.9.0.179; affected 5.10.0 before 5.10.0.376 |
| WSO2 / WSO2 Open Banking KM | unknown 0 before 1.4.0; affected 1.4.0 before 1.4.0.137; affected 1.5.0 before 1.5.0.127 |
| WSO2 / WSO2 Carbon Identity Application Authentication Framework | affected 5.12.153 before 5.12.153.66; affected 5.12.387 before 5.12.387.48; affected 5.14.97 before 5.14.97.94; affected 5.17.5 before 5.17.5.337; affected 5.17.118 before 5.17.118.24; affected 5.18.187 before 5.18.187.334; affected 5.18.248 before 5.18.248.34; affected 5.23.8 before 5.23.8.221; affected 5.24.8 before 5.24.8.29; affected 5.25.92 before 5.25.92.177; affected 5.25.705 before 5.25.705.23; affected 5.25.713 before 5.25.713.12; affected 5.25.724 before 5.25.724.8; affected 5.25.736 before 5.25.736.3; affected 7.0.78 before 7.0.78.171; affected 7.8.23 before 7.8.23.95; affected 7.8.586 before 7.8.586.21; unaffected 5.25.738 through 5.25.*; unaffected 7.8.646 through * |
CWE
CWE-693
References
ADP enrichment
No English description supplied.
No references supplied.