The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.
Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
before 5.7.0 status unknown; from 5.7.0 before 5.7.0.130; from 5.8.0 before 5.8.0.113; from 5.9.0 before 5.9.0.173; from 5.10.0 before 5.10.0.385; from 5.11.0 before 5.11.0.432; from 6.0.0 before 6.0.0.259; from 6.1.0 before 6.1.0.260; and 4 more ranges
before 2.6.0 status unknown; from 2.6.0 before 2.6.0.150; from 3.0.0 before 3.0.0.180; from 3.1.0 before 3.1.0.356; from 3.2.0 before 3.2.0.460; from 3.2.1 before 3.2.1.79; from 4.0.0 before 4.0.0.381; from 4.1.0 before 4.1.0.244; and 5 more ranges
wso2:carbon_identity_application_authentication_framework (from the name)
from 5.12.153 before 5.12.153.66; from 5.12.387 before 5.12.387.48; from 5.14.97 before 5.14.97.94; from 5.17.5 before 5.17.5.337; from 5.17.118 before 5.17.118.24; from 5.18.187 before 5.18.187.334; from 5.18.248 before 5.18.248.34; from 5.23.8 before 5.23.8.221; and 11 more ranges
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
