PT-2025-39180 · Wso2 · Wso2 Adaptive Authentication

Publicado 2025-09-23 · Atualizado 2025-10-06 · CVE-2025-0663

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description A cross-tenant authentication issue exists because of a flawed cryptographic design in Adaptive Authentication. A single cryptographic key is used for all tenants to sign authentication cookies, potentially allowing a privileged user in one tenant to create authentication cookies for users in other tenants.

The Auto-Login feature, when enabled, may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Exploitation requires access to Adaptive Authentication functionality, typically limited to high-privileged users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2025-0663

Produtos afetados

Wso2 Adaptive Authentication

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-0663 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-0663 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1970639140040417631 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1970621803140915557 · Publicação no Twitter
• https://t.me/cveNotify/137493 · Publicação no Telegram
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3864 · Aviso do Fabricante