CVE-2025-9973: identity server from 7.1.0 (inclusive), before 7.1.0.26 (exclusive); +2 more affected products

Affected technology

identity server · from 7.1.0 (inclusive), before 7.1.0.26 (exclusive)
wso2

WSO2 Identity Server · 7.1.0 to before 7.1.0.26
WSO2

Conditional Authentication User and Roles Related Functions · 1.2.76 to before 1.2.76.1
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Adjacent network · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could gain higher privileges under the conditions described by the source. Source advisory’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality and integrity impact as high; availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.