The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured

Overview

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.

Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Affected

• api_control_plane >= 4.5.0, < 4.5.0.45
• api_control_plane >= 4.6.0, < 4.6.0.9
• api_manager >= 2.6.0, < 2.6.0.150
• api_manager >= 3.0.0, < 3.0.0.180
• api_manager >= 3.1.0, < 3.1.0.356
• api_manager >= 3.2.0, < 3.2.0.460
• api_manager >= 3.2.1, < 3.2.1.79
• api_manager >= 4.0.0, < 4.0.0.381
• api_manager >= 4.1.0, < 4.1.0.244
• api_manager >= 4.2.0, < 4.2.0.184
• api_manager >= 4.3.0, < 4.3.0.95
• api_manager >= 4.4.0, < 4.4.0.59
• api_manager >= 4.5.0, < 4.5.0.44
• api_manager >= 4.6.0, < 4.6.0.8
• identity_server >= 5.7.0, < 5.7.0.130
• identity_server >= 5.8.0, < 5.8.0.133
• identity_server >= 5.9.0, < 5.9.0.173
• identity_server >= 5.10.0, < 5.10.0.385
• identity_server >= 5.11.0, < 5.11.0.432
• identity_server >= 6.0.0, < 6.0.0.259
• identity_server >= 6.1.0, < 6.1.0.260
• identity_server >= 7.0.0, < 7.0.0.138
• identity_server >= 7.1.0, < 7.1.0.49
• identity_server >= 7.2.0, < 7.2.0.7
• identity_server_as_key_manager >= 5.7.0, < 5.7.0.129
• identity_server_as_key_manager >= 5.9.0, < 5.9.0.179
• identity_server_as_key_manager >= 5.10.0, < 5.10.0.376
• open_banking_am >= 1.4.0, < 1.4.0.143
• open_banking_am >= 1.5.0, < 1.5.0.144
• open_banking_am >= 2.0.0, < 2.0.0.405
• open_banking_iam >= 2.0.0, < 2.0.0.425
• open_banking_km >= 1.4.0, < 1.4.0.137
• open_banking_km >= 1.5.0, < 1.5.0.127
• traffic_manager >= 4.5.0, < 4.5.0.43
• traffic_manager >= 4.6.0, < 4.6.0.8
• universal_gateway >= 4.5.0, < 4.5.0.44
• universal_gateway >= 4.6.0, < 4.6.0.8

Remediation

Upgrade past the affected range:

• api_control_plane 4.6.0.9
• api_manager 4.6.0.8
• identity_server 7.2.0.7
• identity_server_as_key_manager 5.10.0.376
• open_banking_am 2.0.0.405
• open_banking_iam 2.0.0.425
• open_banking_km 1.5.0.127
• traffic_manager 4.6.0.8
• universal_gateway 4.6.0.8