WSO2 Identity Server Flaw Disclosed

A medium-severity vulnerability (CVE-2025-9973) in WSO2 Identity Server lets an attacker with admin rights in one organization run adaptive authentication logic against other organizations in the same deployment, breaking tenant isolation. This puts multi-tenant WSO2 customers at risk of cross-org privilege escalation and account takeover. Administrators should apply WSO2's patch, audit adaptive authentication scripts, and review access logs across organizations.