CVE-2025-15039 affects WSO2's Conditional Authentication (Adaptive Authentication) script, which fails to correctly enforce the completion of all required authentication steps in specific multi-step configurations. An attacker can bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation grants unauthorized access to targeted user accounts. The vulnerability requires a specific set of conditions: a secondary authenticator in the login flow, particular event callbacks configured in the script, the targeted user having an impacted authenticator enrolled, and the attacker completing prior authentication steps. This is a logic flaw in the authentication flow rather than a code injection issue. WSO2 has published a security advisory addressing this issue. The vulnerability poses a high risk to organizations using WSO2 identity management solutions with adaptive authentication enabled.