CVE-2025-9973

CVE-2025-9973 is a medium-severity vulnerability in Wso2 Identity Server with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-284.

Key facts

Description

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations.

Frequently asked questions

What is CVE-2025-9973?
Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations.
How severe is CVE-2025-9973?
CVE-2025-9973 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2025-9973 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-9973?
CVE-2025-9973 affects Wso2 Identity Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-9973?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-9973 have an EU (EUVD) identifier?
Yes. CVE-2025-9973 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-209762.
When was CVE-2025-9973 published?
CVE-2025-9973 was published on 2026-05-11 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Wso2 Identity Server

All CVEs affecting Wso2 Identity Server →

Other CWE-284 (Improper Access Control) vulnerabilities

Browse all CWE-284 (Improper Access Control) vulnerabilities →