The vulnerability arises from improper enforcement in the Conditional Authentication script of WSO2 Identity Server when configured with a specific multi-step authentication pattern involving certain secondary authenticators. The script mishandles callbacks and re-execution of authentication steps, enabling an attacker who completes preceding steps to bypass intermediate challenges. Exploitation requires the presence of a particular secondary authenticator in the login flow, the use of event callbacks in the script, and the targeted user having an impacted authenticator enrolled. This results in unauthorized access to the targeted user account.

Successful exploitation leads to unauthorized access to user accounts, compromising confidentiality and integrity of user sessions. The vulnerability has a CVSS 3.1 base score of 9.4 (critical), indicating high impact with network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact with low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Organizations using affected versions should monitor vendor communications for patches and consider reviewing Conditional Authentication scripts and multi-step authentication configurations to identify potential risky patterns until a fix is available.