CVE-2025-0663
Full vulnerability record from the local CVENow database.
Description
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication cookies for users in other tenants. Because the Auto-Login feature is enabled by default, this flaw may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Successful exploitation requires access to Adaptive Authentication functionality, which is typically restricted to high-privileged users. The vulnerability is only exploitable when Auto-Login is enabled, reducing its practical impact in deployments where the feature is disabled.
Severity
MEDIUM
CVSS score
6.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2025-09-23 17:15:32.143000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-0663",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2025-09-23T17:15:32.143",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication cookies for users in other tenants.\n\nBecause the Auto-Login feature is enabled by default, this flaw may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Successful exploitation requires access to Adaptive Authentication functionality, which is typically restricted to high-privileged users. The vulnerability is only exploitable when Auto-Login is enabled, reducing its practical impact in deployments where the feature is disabled."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de autenticación entre inquilinos en múltiples productos WSO2 debido a un diseño criptográfico inadecuado en la Autenticación Adaptativa. Se utiliza una única clave criptográfica en todos los inquilinos para firmar cookies de autenticación, lo que permite a un usuario privilegiado en un inquilino forjar cookies de autenticación para usuarios en otros inquilinos.\n\nDebido a que la función de inicio de sesión automático (Auto-Login) está habilitada por defecto, este fallo puede permitir a un atacante obtener acceso no autorizado y potencialmente tomar el control de cuentas en otros inquilinos. La explotación exitosa requiere acceso a la funcionalidad de Autenticación Adaptativa, que normalmente está restringida a usuarios con altos privilegios. La vulnerabilidad solo es explotable cuando el inicio de sesión automático (Auto-Login) está habilitado, reduciendo su impacto práctico en implementaciones donde la función está deshabilitada."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 Open Banking IAM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.0.0",
"lessThan": "2.0.0.387",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.10.0",
"lessThan": "5.10.0.336",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.10.0",
"lessThan": "5.10.0.343",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.11.0",
"lessThan": "5.11.0.392",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.0.0",
"lessThan": "6.0.0.228",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.1.0",
"lessThan": "6.1.0.220",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.0",
"lessThan": "7.0.0.88",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-23T18:30:57.677681Z",
"id": "CVE-2025-0663",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7B81C488-69D0-4A5C-AEED-31869C1BF5CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "65CD2558-C60C-4296-8E96-D4D804C598F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B8DF49C6-F2F6-4229-982E-0C0559265203"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE"
}
]
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3864/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
]
}
]
}