CVE-2025-15039
CriticalCVSS 9.4Summary
The Conditional Authentication script does not correctly enforce the completion of all required authentication steps in a specific multi-step pattern. An attacker can bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution.
Risk Assessment
Successful exploitation allows unauthorized access to a targeted user account. The vulnerability requires specific conditions, including a particular authenticator and script configuration.
Recommendation
Fix the Conditional Authentication script logic to enforce completion of all authentication steps. Review authentication configuration and conduct security testing.
Original NVD description (English source)
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.