PT-2026-39593 · Wso2 · Wso2 Identity Server

Published 2026-05-11 · Updated 2026-05-27 · CVE-2025-9973

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server (affected versions not specified)

Description In multi-organization deployments, the software fails to validate the organization context during the execution of adaptive authentication flows. This allows a malicious actor with configuration privileges in one organization to trigger authentication logic across other organizations and sub-organizations. This flaw enables the bypass of authorization boundaries, potentially leading to privilege escalation, unauthorized access to critical operations and resources, and account takeover across different organizations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2025-9973

Affected Products

Wso2 Identity Server

References · 7

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9973 · Security Note
• https://t.me/CVEtracker/53372 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053818313751306720 · Twitter Post
• https://t.me/cveNotify/164907 · Telegram Post
• https://t.me/cveNotify/163026 · Telegram Post
• https://twitter.com/CVEnew/status/2053954484238246383 · Twitter Post