CVE-2025-9973 — Privilege Escalation

title: WSO2 Identity Server - Adaptive Authentication Bypass (CVE-2025-9973)
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  Detects requests to WSO2 Identity Server that attempt to leverage the adaptive authentication flow across different organizations, indicating a potential exploitation of CVE-2025-9973. This rule specifically looks for the '/t/organizations/' path combined with 'adaptive-auth' in the query string, which is characteristic of the vulnerability allowing authentication logic to be triggered on unintended organizations.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-9973/
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/t/organizations/'
      cs-uri-query|contains:
          - 'adaptive-auth'
      sc-status:
          - 200
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse