CVE-2025-15039

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The Conditional Authentication (Adaptive Authentication) script fails to correctly enforce the completion of all required authentication steps during specific multi-step patterns involving certain authenticators. An attacker can bypass intermediate authentication challenges by exploiting the script's handling of callbacks and the re-execution of authentication steps. This allows unauthorized access to targeted user accounts if the login flow includes a specific secondary authenticator, the script is configured with particular event callbacks that trigger step re-execution, the user has an impacted authenticator enrolled, and the attacker completes the initial authentication steps.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.