The vulnerability arises from improper enforcement in the Conditional Authentication script of WSO2 Identity Server when handling multi-step authentication flows that include specific secondary authenticators and event callbacks. The script's handling of callbacks and re-execution of authentication steps can be exploited to bypass intermediate authentication challenges. Successful exploitation requires that the targeted user has an impacted authenticator enrolled, the attacker completes any preceding authentication steps, and the login flow is configured with the vulnerable pattern. This results in unauthorized access to user accounts.

An attacker who successfully exploits this vulnerability can bypass intermediate authentication steps and gain unauthorized access to targeted user accounts. This compromises confidentiality and integrity of user sessions and data. The CVSS score of 9.4 (critical) reflects the high impact on confidentiality and integrity with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Organizations should monitor WSO2 advisories for updates and consider reviewing and tightening Conditional Authentication scripts and multi-step authentication configurations as a precaution.