PT-2025-39180 · Wso2 · Wso2 Adaptive Authentication

Published 2025-09-23 · Updated 2025-10-06 · CVE-2025-0663

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description A cross-tenant authentication issue exists because of a flawed cryptographic design in Adaptive Authentication. A single cryptographic key is used for all tenants to sign authentication cookies, potentially allowing a privileged user in one tenant to create authentication cookies for users in other tenants.

The Auto-Login feature, when enabled, may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Exploitation requires access to Adaptive Authentication functionality, typically limited to high-privileged users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-0663

Affected Products

Wso2 Adaptive Authentication

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-0663 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0663 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3864 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1970639140040417631 · Twitter Post
• https://twitter.com/CVEnew/status/1970621803140915557 · Twitter Post
• https://t.me/cveNotify/137493 · Telegram Post