CVE-2025-9973 Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "affected",
        "version": "7.1.0",
        "lessThan": "7.1.0.26",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "Conditional Authentication User and Roles Related Functions",
    "packageName": "org.wso2.carbon.identity.conditional.auth.functions:org.wso2.carbon.identity.conditional.auth.functions.user",
    "versions": [
      {
        "status": "affected",
        "version": "1.2.76",
        "lessThan": "1.2.76.1",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.2.82",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]