Issue:
Bug: [BUG] Add additional authentication fields for 3ds external authentication



### Bug Description

Cybersource payments via Netcetera are failing for a France based acquirer in prod with Carte Bancaires card, the below fields needs to be added to fix the same.

1. challenge_code
2. challenge_code_reason
3. challenge_cancel
4. message_extension



### Expected Behavior

Payments are currently failing in prod a france based acquirer

### Actual Behavior

Payments should pass



### Steps To Reproduce

Provide an unambiguous set of steps to reproduce this bug. Include code or configuration to reproduce, if relevant.
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'


### Context For The Bug

_No response_

### Environment

Are you using hyperswitch hosted version? Yes/No
If yes, please provide the value of the `x-request-id` response header to help us debug your issue.

If not (or if building/running locally), please provide the following details:
1. Operating System or Linux distribution:
2. Rust version (output of `rustc --version`): ``
3. App version (output of `cargo r --features vergen -- --version`): ``


### Have you spent some time checking if this bug has been raised before?

- [x] I checked and didn't find a similar issue

### Have you read the Contributing Guidelines?

- [x] I have read the [Contributing Guidelines](https://github.com/juspay/hyperswitch/blob/main/docs/CONTRIBUTING.md)

### Are you willing to submit a PR?

Yes, I am willing to submit a PR!

Pull request description:
## Type of Change
<!-- Put an `x` in the boxes that apply -->

- [ ] Bugfix
- [ ] New feature
- [X] Enhancement
- [ ] Refactoring
- [ ] Dependency updates
- [ ] Documentation
- [ ] CI/CD

## Description
This PR introduces the following changes
 1. Added additional authentication fields for 3ds external authentication, the fields are as following
  - challenge_code
  - challenge_code_reason
  - challenge_cancel
  - message_extension
 2. Added additional fields for Cybersource payments request corresponding to the newly added auth fields
 3. Added additional request fields for Netcetera, and other 3ds connectors corresponding to the newly added auth fields
 
Context - Cybersource payments via Netcetera are failing for a France based acquirer in prod, the above fields are added to fix the same.

### Additional Changes

- [ ] This PR modifies the API contract
- [ ] This PR modifies the database schema
- [ ] This PR modifies application configuration/environment variables

<!--
Provide links to the files with corresponding changes.

Following are the paths where you can find config files:
1. `config`
6. `crates/router/src/configs`
7. `loadtest/config`
-->


## Motivation and Context
<!--
Why is this change required? What problem does it solve?
If it fixes an open issue, please link to the issue here.

If you don't have an issue, we'd recommend starting with one first so the PR
can focus on the implementation (unless it is an obvious bug or documentation fix
that will have little conversation).
-->


## How did you test it?
<!--
Did you write an integration/unit/API test to verify the code changes?
Or did you test this change manually (provide relevant screenshots)?
-->

### Card used for testing (mastercard with challenge flow)

5306 8899 4283 3340

### Successful 3DS challenge completion flow 

  _Tested using local hyperswitch sdk and hyperswitch backend_ 

[Test video](https://drive.google.com/file/d/1rV5mnly1WdvLk8Ff1_r16vAxBqgGJVUJ/view?usp=sharing)

Connector Request for Cybersource: 
<img width="1720" height="321" alt="Screenshot 2025-07-30 at 8 39 57 PM" src="https://github.com/user-attachments/assets/3fa4c555-7d11-4482-b232-baa8713af24c" />

> cavvAlgorithm - "02"
> paresStatus - "Y"
> challengeCode - Null (Please note - This is not supposed to be null, checking with Netcetera team since it's coming as None from Netcetera) Fix merged in [PR](https://github.com/juspay/hyperswitch/pull/8850) 
> paresStatusReason - Null (Please note - Null is not expected here,checking this with Netcetera team) Fix raised here [PR](https://github.com/juspay/hyperswitch/pull/8907) 
> challengeCancelCode - Null (Please note - Null is expected here, as challenge is not cancelled)
> networkScore - Null (Please note - Null is expected here, as card is not CartesBancaires and also since it is not production environment - messageExtension field is only available on production)
> acsTransactionId - "9187c2cb-54f8-4e70-a63b-537046c2b34d"


### 3DS challenge cancel flow

   _Tested using local hyperswitch sdk and hyperswitch backend_ 
[Test video](https://drive.google.com/file/d/1jIAtfLotxhZsroT-xYUEttUXapuRn0Sv/view?usp=sharing)

Incoming Webhook from Netcetera on cancelling challenge: 
<img width="1720" height="198" alt="Screenshot 2025-07-30 at 9 23 53 PM" src="https://github.com/user-attachments/assets/93b0eacd-676c-4d88-993b-77ef78e3da90" />



## Checklist
<!-- Put an `x` in the boxes that apply -->

- [X] I formatted the code `cargo +nightly fmt --all`
- [X] I addressed lints thrown by `cargo clippy`
- [X] I reviewed the submitted code
- [ ] I added unit tests for my changes where possible


Testing:


### Card used for testing (mastercard with challenge flow)

5306 8899 4283 3340

### Successful 3DS challenge completion flow 

  _Tested using local hyperswitch sdk and hyperswitch backend_ 

[Test video](https://drive.google.com/file/d/1rV5mnly1WdvLk8Ff1_r16vAxBqgGJVUJ/view?usp=sharing)

Connector Request for Cybersource: 
<img width="1720" height="321" alt="Screenshot 2025-07-30 at 8 39 57 PM" src="https://github.com/user-attachments/assets/3fa4c555-7d11-4482-b232-baa8713af24c" />

> cavvAlgorithm - "02"
> paresStatus - "Y"
> challengeCode - Null (Please note - This is not supposed to be null, checking with Netcetera team since it's coming as None from Netcetera) Fix merged in [PR](https://github.com/juspay/hyperswitch/pull/8850) 
> paresStatusReason - Null (Please note - Null is not expected here,checking this with Netcetera team) Fix raised here [PR](https://github.com/juspay/hyperswitch/pull/8907) 
> challengeCancelCode - Null (Please note - Null is expected here, as challenge is not cancelled)
> networkScore - Null (Please note - Null is expected here, as card is not CartesBancaires and also since it is not production environment - messageExtension field is only available on production)
> acsTransactionId - "9187c2cb-54f8-4e70-a63b-537046c2b34d"


### 3DS challenge cancel flow

   _Tested using local hyperswitch sdk and hyperswitch backend_ 
[Test video](https://drive.google.com/file/d/1jIAtfLotxhZsroT-xYUEttUXapuRn0Sv/view?usp=sharing)

Incoming Webhook from Netcetera on cancelling challenge: 
<img width="1720" height="198" alt="Screenshot 2025-07-30 at 9 23 53 PM" src="https://github.com/user-attachments/assets/93b0eacd-676c-4d88-993b-77ef78e3da90" />

Patch:
diff --git a/crates/diesel_models/src/authentication.rs b/crates/diesel_models/src/authentication.rs
index 915d661bad2..c844df0a699 100644
--- a/crates/diesel_models/src/authentication.rs
+++ b/crates/diesel_models/src/authentication.rs
@@ -1,4 +1,4 @@
-use common_utils::encryption::Encryption;
+use common_utils::{encryption::Encryption, pii};
 use diesel::{AsChangeset, Identifiable, Insertable, Queryable, Selectable};
 use serde::{self, Deserialize, Serialize};
 use serde_json;
@@ -61,6 +61,10 @@ pub struct Authentication {
     pub browser_info: Option<serde_json::Value>,
     pub email: Option<Encryption>,
     pub profile_acquirer_id: Option<common_utils::id_type::ProfileAcquirerId>,
+    pub challenge_code: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
+    pub message_extension: Option<pii::SecretSerdeValue>,
 }
 
 impl Authentication {
@@ -121,6 +125,10 @@ pub struct AuthenticationNew {
     pub browser_info: Option<serde_json::Value>,
     pub email: Option<Encryption>,
     pub profile_acquirer_id: Option<common_utils::id_type::ProfileAcquirerId>,
+    pub challenge_code: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
+    pub message_extension: Option<pii::SecretSerdeValue>,
 }
 
 #[derive(Debug)]
@@ -167,11 +175,17 @@ pub enum AuthenticationUpdate {
         authentication_status: common_enums::AuthenticationStatus,
         ds_trans_id: Option<String>,
         eci: Option<String>,
+        challenge_code: Option<String>,
+        challenge_cancel: Option<String>,
+        challenge_code_reason: Option<String>,
+        message_extension: Option<pii::SecretSerdeValue>,
     },
     PostAuthenticationUpdate {
         trans_status: common_enums::TransactionStatus,
         eci: Option<String>,
         authentication_status: common_enums::AuthenticationStatus,
+        challenge_cancel: Option<String>,
+        challenge_code_reason: Option<String>,
     },
     ErrorUpdate {
         error_message: Option<String>,
@@ -227,6 +241,10 @@ pub struct AuthenticationUpdateInternal {
     pub browser_info: Option<serde_json::Value>,
     pub email: Option<Encryption>,
     pub profile_acquirer_id: Option<common_utils::id_type::ProfileAcquirerId>,
+    pub challenge_code: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
+    pub message_extension: Option<pii::SecretSerdeValue>,
 }
 
 impl Default for AuthenticationUpdateInternal {
@@ -267,6 +285,10 @@ impl Default for AuthenticationUpdateInternal {
             browser_info: Default::default(),
             email: Default::default(),
             profile_acquirer_id: Default::default(),
+            challenge_code: Default::default(),
+            challenge_cancel: Default::default(),
+            challenge_code_reason: Default::default(),
+            message_extension: Default::default(),
         }
     }
 }
@@ -309,6 +331,10 @@ impl AuthenticationUpdateInternal {
             browser_info,
             email,
             profile_acquirer_id,
+            challenge_code,
+            challenge_cancel,
+            challenge_code_reason,
+            message_extension,
         } = self;
         Authentication {
             connector_authentication_id: connector_authentication_id
@@ -350,6 +376,10 @@ impl AuthenticationUpdateInternal {
             browser_info: browser_info.or(source.browser_info),
             email: email.or(source.email),
             profile_acquirer_id: profile_acquirer_id.or(source.profile_acquirer_id),
+            challenge_code: challenge_code.or(source.challenge_code),
+            challenge_cancel: challenge_cancel.or(source.challenge_cancel),
+            challenge_code_reason: challenge_code_reason.or(source.challenge_code_reason),
+            message_extension: message_extension.or(source.message_extension),
             ..source
         }
     }
@@ -438,6 +468,10 @@ impl From<AuthenticationUpdate> for AuthenticationUpdateInternal {
                 authentication_status,
                 ds_trans_id,
                 eci,
+                challenge_code,
+                challenge_cancel,
+                challenge_code_reason,
+                message_extension,
             } => Self {
                 trans_status: Some(trans_status),
                 authentication_type: Some(authentication_type),
@@ -450,16 +484,24 @@ impl From<AuthenticationUpdate> for AuthenticationUpdateInternal {
                 authentication_status: Some(authentication_status),
                 ds_trans_id,
                 eci,
+                challenge_code,
+                challenge_cancel,
+                challenge_code_reason,
+                message_extension,
                 ..Default::default()
             },
             AuthenticationUpdate::PostAuthenticationUpdate {
                 trans_status,
                 eci,
                 authentication_status,
+                challenge_cancel,
+                challenge_code_reason,
             } => Self {
                 trans_status: Some(trans_status),
                 eci,
                 authentication_status: Some(authentication_status),
+                challenge_cancel,
+                challenge_code_reason,
                 ..Default::default()
             },
             AuthenticationUpdate::PreAuthenticationVersionCallUpdate {
diff --git a/crates/diesel_models/src/schema.rs b/crates/diesel_models/src/schema.rs
index c141f765536..16eb56df20d 100644
--- a/crates/diesel_models/src/schema.rs
+++ b/crates/diesel_models/src/schema.rs
@@ -137,6 +137,10 @@ diesel::table! {
         email -> Nullable<Bytea>,
         #[max_length = 128]
         profile_acquirer_id -> Nullable<Varchar>,
+        challenge_code -> Nullable<Varchar>,
+        challenge_cancel -> Nullable<Varchar>,
+        challenge_code_reason -> Nullable<Varchar>,
+        message_extension -> Nullable<Jsonb>,
     }
 }
 
diff --git a/crates/diesel_models/src/schema_v2.rs b/crates/diesel_models/src/schema_v2.rs
index e434e43b2c6..08fdecfd107 100644
--- a/crates/diesel_models/src/schema_v2.rs
+++ b/crates/diesel_models/src/schema_v2.rs
@@ -137,6 +137,10 @@ diesel::table! {
         email -> Nullable<Bytea>,
         #[max_length = 128]
         profile_acquirer_id -> Nullable<Varchar>,
+        challenge_code -> Nullable<Varchar>,
+        challenge_cancel -> Nullable<Varchar>,
+        challenge_code_reason -> Nullable<Varchar>,
+        message_extension -> Nullable<Jsonb>,
     }
 }
 
diff --git a/crates/hyperswitch_connectors/src/connectors/cybersource/transformers.rs b/crates/hyperswitch_connectors/src/connectors/cybersource/transformers.rs
index 2112989969e..ffef8b20c07 100644
--- a/crates/hyperswitch_connectors/src/connectors/cybersource/transformers.rs
+++ b/crates/hyperswitch_connectors/src/connectors/cybersource/transformers.rs
@@ -34,8 +34,9 @@ use hyperswitch_domain_models::{
         SetupMandate,
     },
     router_request_types::{
-        CompleteAuthorizeData, PaymentsAuthorizeData, PaymentsCancelData, PaymentsCaptureData,
-        PaymentsPreProcessingData, PaymentsSyncData, ResponseId, SetupMandateRequestData,
+        authentication::MessageExtensionAttribute, CompleteAuthorizeData, PaymentsAuthorizeData,
+        PaymentsCancelData, PaymentsCaptureData, PaymentsPreProcessingData, PaymentsSyncData,
+        ResponseId, SetupMandateRequestData,
     },
     router_response_types::{
         MandateReference, PaymentsResponseData, RedirectForm, RefundsResponseData,
@@ -313,6 +314,7 @@ impl TryFrom<&SetupMandateRouterData> for CybersourceZeroMandateRequest {
                 ))?
             }
         };
+        let cavv_algorithm = Some("2".to_string());
 
         let processing_information = ProcessingInformation {
             capture: Some(false),
@@ -322,6 +324,7 @@ impl TryFrom<&SetupMandateRouterData> for CybersourceZeroMandateRequest {
             authorization_options,
             commerce_indicator: String::from("internet"),
             payment_solution: solution.map(String::from),
+            cavv_algorithm,
         };
         Ok(Self {
             processing_information,
@@ -355,6 +358,7 @@ pub struct ProcessingInformation {
     capture: Option<bool>,
     capture_options: Option<CaptureOptions>,
     payment_solution: Option<String>,
+    cavv_algorithm: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -389,6 +393,7 @@ pub struct CybersourceConsumerAuthInformation {
     /// Raw electronic commerce indicator (ECI)
     eci_raw: Option<String>,
     /// This field is supported only on Asia, Middle East, and Africa Gateway
+    /// Also needed for Credit Mutuel-CIC in France and Mastercard Identity Check transactions
     /// This field is only applicable for Mastercard and Visa Transactions
     pares_status: Option<CybersourceParesStatus>,
     //This field is used to send the authentication date in yyyyMMDDHHMMSS format
@@ -396,6 +401,16 @@ pub struct CybersourceConsumerAuthInformation {
     /// This field indicates the 3D Secure transaction flow. It is only supported for secure transactions in France.
     /// The possible values are - CH (Challenge), FD (Frictionless with delegation), FR (Frictionless)
     effective_authentication_type: Option<EffectiveAuthenticationType>,
+    /// This field indicates the authentication type or challenge presented to the cardholder at checkout.
+    challenge_code: Option<String>,
+    /// This field indicates the reason for payer authentication response status. It is only supported for secure transactions in France.
+    pares_status_reason: Option<String>,
+    /// This field indicates the reason why strong authentication was cancelled. It is only supported for secure transactions in France.
+    challenge_cancel_code: Option<String>,
+    /// This field indicates the score calculated by the 3D Securing platform. It is only supported for secure transactions in France.
+    network_score: Option<u32>,
+    /// This is the transaction ID generated by the access control server. This field is supported only for secure transactions in France.
+    acs_transaction_id: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -971,6 +986,11 @@ impl
                     .map(|eci| get_commerce_indicator_for_external_authentication(network, eci))
             });
 
+        // The 3DS Server might not include the `cavvAlgorithm` field in the challenge response.
+        // In such cases, we default to "2", which represents the CVV with Authentication Transaction Number (ATN) algorithm.
+        // This is the most commonly used value for 3DS 2.0 transactions (e.g., Visa, Mastercard).
+        let cavv_algorithm = Some("2".to_string());
+
         Ok(Self {
             capture: Some(matches!(
                 item.router_data.request.capture_method,
@@ -983,6 +1003,7 @@ impl
             capture_options: None,
             commerce_indicator: commerce_indicator_for_external_authentication
                 .unwrap_or(commerce_indicator),
+            cavv_algorithm,
         })
     }
 }
@@ -1079,6 +1100,8 @@ impl
             } else {
                 (None, None, None)
             };
+        let cavv_algorithm = Some("2".to_string());
+
         Ok(Self {
             capture: Some(matches!(
                 item.router_data.request.capture_method,
@@ -1093,6 +1116,7 @@ impl
                 .indicator
                 .to_owned()
                 .unwrap_or(String::from("internet")),
+            cavv_algorithm,
         })
     }
 }
@@ -1241,6 +1265,53 @@ fn convert_metadata_to_merchant_defined_info(metadata: Value) -> Vec<MerchantDef
     vector
 }
 
+/*
+Example Message Extension:
+
+[
+    MessageExtensionAttribute {
+        name: "CB-SCORE".to_string(),
+        id: "A000000042_CB-SCORE".to_string(),
+        criticality_indicator: false,
+        data: "some value".to_string(),
+    },
+]
+
+In this case, the **network score** is `42`, which should be extracted from the `id` field.
+The score is encoded in the numeric part of the `id` (after removing the leading 'A' and before the underscore).
+
+Note: This field represents the score calculated by the 3D Securing platform.
+It is only supported for secure transactions in France.
+*/
+
+fn extract_score_id(message_extensions: &[MessageExtensionAttribute]) -> Option<u32> {
+    message_extensions.iter().find_map(|attr| {
+        attr.id
+            .ends_with("CB-SCORE")
+            .then(|| {
+                attr.id
+                    .split('_')
+                    .next()
+                    .and_then(|p| p.strip_prefix('A'))
+                    .and_then(|s| {
+                        s.parse::<u32>().map(Some).unwrap_or_else(|err| {
+                            router_env::logger::error!(
+                                "Failed to parse score_id from '{}': {}",
+                                s,
+                                err
+                            );
+                            None
+                        })
+                    })
+                    .or_else(|| {
+                        router_env::logger::error!("Unexpected prefix format in id: {}", attr.id);
+                        None
+                    })
+            })
+            .flatten()
+    })
+}
+
 impl From<common_enums::DecoupledAuthenticationType> for EffectiveAuthenticationType {
     fn from(auth_type: common_enums::DecoupledAuthenticationType) -> Self {
         match auth_type {
@@ -1289,12 +1360,10 @@ impl
             None => ccard.get_card_issuer().ok().map(String::from),
         };
 
-        let pares_status =
-            if card_type == Some("001".to_string()) || card_type == Some("002".to_string()) {
-                Some(CybersourceParesStatus::AuthenticationSuccessful)
-            } else {
-                None
-            };
+        // For all card payments, we are explicitly setting `pares_status` to `AuthenticationSuccessful`
+        // to indicate that the Payer Authentication was successful, regardless of actual ACS response.
+        // This is a default behavior and may be adjusted based on future integration requirements.
+        let pares_status = Some(CybersourceParesStatus::AuthenticationSuccessful);
 
         let security_code = if item
             .router_data
@@ -1349,7 +1418,29 @@ impl
                 )
                 .ok();
                 let effective_authentication_type = authn_data.authentication_type.map(Into::into);
-
+                let network_score: Option<u32> =
+                    if ccard.card_network == Some(common_enums::CardNetwork::CartesBancaires) {
+                        match authn_data.message_extension.as_ref() {
+                            Some(secret) => {
+                                let exposed_value = secret.clone().expose();
+                                match serde_json::from_value::<Vec<MessageExtensionAttribute>>(
+                                    exposed_value,
+                                ) {
+                                    Ok(exts) => extract_score_id(&exts),
+                                    Err(err) => {
+                                        router_env::logger::error!(
+                                            "Failed to deserialize message_extension: {:?}",
+                                            err
+                                        );
+                                        None
+                                    }
+                                }
+                            }
+                            None => None,
+                        }
+                    } else {
+                        None
+                    };
                 CybersourceConsumerAuthInformation {
                     pares_status,
                     ucaf_collection_indicator,
@@ -1366,6 +1457,11 @@ impl
                     eci_raw: authn_data.eci.clone(),
                     authentication_date,
                     effective_authentication_type,
+                    challenge_code: authn_data.challenge_code.clone(),
+                    pares_status_reason: authn_data.challenge_code_reason.clone(),
+                    challenge_cancel_code: authn_data.challenge_cancel.clone(),
+                    network_score,
+                    acs_transaction_id: authn_data.acs_trans_id.clone(),
                 }
             });
 
@@ -1406,12 +1502,10 @@ impl
             Err(_) => None,
         };
 
-        let pares_status =
-            if card_type == Some("001".to_string()) || card_type == Some("002".to_string()) {
-                Some(CybersourceParesStatus::AuthenticationSuccessful)
-            } else {
-                None
-            };
+        // For all card payments, we are explicitly setting `pares_status` to `AuthenticationSuccessful`
+        // to indicate that the Payer Authentication was successful, regardless of actual ACS response.
+        // This is a default behavior and may be adjusted based on future integration requirements.
+        let pares_status = Some(CybersourceParesStatus::AuthenticationSuccessful);
 
         let payment_information = PaymentInformation::Cards(Box::new(CardPaymentInformation {
             card: Card {
@@ -1451,6 +1545,29 @@ impl
                     date_time::DateFormat::YYYYMMDDHHmmss,
                 )
                 .ok();
+                let network_score: Option<u32> =
+                    if ccard.card_network == Some(common_enums::CardNetwork::CartesBancaires) {
+                        match authn_data.message_extension.as_ref() {
+                            Some(secret) => {
+                                let exposed_value = secret.clone().expose();
+                                match serde_json::from_value::<Vec<MessageExtensionAttribute>>(
+                                    exposed_value,
+                                ) {
+                                    Ok(exts) => extract_score_id(&exts),
+                                    Err(err) => {
+                                        router_env::logger::error!(
+                                            "Failed to deserialize message_extension: {:?}",
+                                            err
+                                        );
+                                        None
+                                    }
+                                }
+                            }
+                            None => None,
+                        }
+                    } else {
+                        None
+                    };
                 CybersourceConsumerAuthInformation {
                     pares_status,
                     ucaf_collection_indicator,
@@ -1467,6 +1584,11 @@ impl
                     eci_raw: authn_data.eci.clone(),
                     authentication_date,
                     effective_authentication_type,
+                    challenge_code: authn_data.challenge_code.clone(),
+                    pares_status_reason: authn_data.challenge_code_reason.clone(),
+                    challenge_cancel_code: authn_data.challenge_cancel.clone(),
+                    network_score,
+                    acs_transaction_id: authn_data.acs_trans_id.clone(),
                 }
             });
 
@@ -1510,12 +1632,10 @@ impl
             Err(_) => None,
         };
 
-        let pares_status =
-            if card_type == Some("001".to_string()) || card_type == Some("002".to_string()) {
-                Some(CybersourceParesStatus::AuthenticationSuccessful)
-            } else {
-                None
-            };
+        // For all card payments, we are explicitly setting `pares_status` to `AuthenticationSuccessful`
+        // to indicate that the Payer Authentication was successful, regardless of actual ACS response.
+        // This is a default behavior and may be adjusted based on future integration requirements.
+        let pares_status = Some(CybersourceParesStatus::AuthenticationSuccessful);
 
         let payment_information =
             PaymentInformation::NetworkToken(Box::new(NetworkTokenPaymentInformation {
@@ -1556,6 +1676,30 @@ impl
                     date_time::DateFormat::YYYYMMDDHHmmss,
                 )
                 .ok();
+                let network_score: Option<u32> = if token_data.card_network
+                    == Some(common_enums::CardNetwork::CartesBancaires)
+                {
+                    match authn_data.message_extension.as_ref() {
+                        Some(secret) => {
+                            let exposed_value = secret.clone().expose();
+                            match serde_json::from_value::<Vec<MessageExtensionAttribute>>(
+                                exposed_value,
+                            ) {
+                                Ok(exts) => extract_score_id(&exts),
+                                Err(err) => {
+                                    router_env::logger::error!(
+                                        "Failed to deserialize message_extension: {:?}",
+                                        err
+                                    );
+                                    None
+                                }
+                            }
+                        }
+                        None => None,
+                    }
+                } else {
+                    None
+                };
                 CybersourceConsumerAuthInformation {
                     pares_status,
                     ucaf_collection_indicator,
@@ -1572,6 +1716,11 @@ impl
                     eci_raw: authn_data.eci.clone(),
                     authentication_date,
                     effective_authentication_type,
+                    challenge_code: authn_data.challenge_code.clone(),
+                    pares_status_reason: authn_data.challenge_code_reason.clone(),
+                    challenge_cancel_code: authn_data.challenge_cancel.clone(),
+                    network_score,
+                    acs_transaction_id: authn_data.acs_trans_id.clone(),
                 }
             });
 
@@ -1707,12 +1856,10 @@ impl
             None => ccard.get_card_issuer().ok().map(String::from),
         };
 
-        let pares_status =
-            if card_type == Some("001".to_string()) || card_type == Some("002".to_string()) {
-                Some(CybersourceParesStatus::AuthenticationSuccessful)
-            } else {
-                None
-            };
+        // For all card payments, we are explicitly setting `pares_status` to `AuthenticationSuccessful`
+        // to indicate that the Payer Authentication was successful, regardless of actual ACS response.
+        // This is a default behavior and may be adjusted based on future integration requirements.
+        let pares_status = Some(CybersourceParesStatus::AuthenticationSuccessful);
 
         let payment_information = PaymentInformation::Cards(Box::new(CardPaymentInformation {
             card: Card {
@@ -1757,6 +1904,11 @@ impl
             eci_raw: None,
             authentication_date: None,
             effective_authentication_type: None,
+            challenge_code: None,
+            pares_status_reason: None,
+            challenge_cancel_code: None,
+            network_score: None,
+            acs_transaction_id: None,
         });
 
         let merchant_defined_information = item
@@ -1855,6 +2007,11 @@ impl
                 eci_raw: None,
                 authentication_date: None,
                 effective_authentication_type: None,
+                challenge_code: None,
+                pares_status_reason: None,
+                challenge_cancel_code: None,
+                network_score: None,
+                acs_transaction_id: None,
             }),
             merchant_defined_information,
         })
@@ -2000,6 +2157,11 @@ impl
                 eci_raw: None,
                 authentication_date: None,
                 effective_authentication_type: None,
+                challenge_code: None,
+                pares_status_reason: None,
+                challenge_cancel_code: None,
+                network_score: None,
+                acs_transaction_id: None,
             }),
             merchant_defined_information,
         })
@@ -2202,6 +2364,11 @@ impl TryFrom<&CybersourceRouterData<&PaymentsAuthorizeRouterData>> for Cybersour
                                                 eci_raw: None,
                                                 authentication_date: None,
                                                 effective_authentication_type: None,
+                                                challenge_code: None,
+                                                pares_status_reason: None,
+                                                challenge_cancel_code: None,
+                                                network_score: None,
+                                                acs_transaction_id: None,
                                             },
                                         ),
                                     })
@@ -2471,6 +2638,7 @@ impl TryFrom<&CybersourceRouterData<&PaymentsCaptureRouterData>>
         )
         .then_some(true);
 
+        let cavv_algorithm = Some("2".to_string());
         Ok(Self {
             processing_information: ProcessingInformation {
                 capture_options: Some(CaptureOptions {
@@ -2484,6 +2652,7 @@ impl TryFrom<&CybersourceRouterData<&PaymentsCaptureRouterData>>
                 capture: None,
                 commerce_indicator: String::from("internet"),
                 payment_solution: None,
+                cavv_algorithm,
             },
             order_information: OrderInformationWithBill {
                 amount_details: Amount {
@@ -2509,6 +2678,7 @@ impl TryFrom<&CybersourceRouterData<&PaymentsIncrementalAuthorizationRouterData>
     ) -> Result<Self, Self::Error> {
         let connector_merchant_config =
             CybersourceConnectorMetadataObject::try_from(&item.router_data.connector_meta_data)?;
+        let cavv_algorithm = Some("2".to_string());
 
         Ok(Self {
             processing_information: ProcessingInformation {
@@ -2532,6 +2702,7 @@ impl TryFrom<&CybersourceRouterData<&PaymentsIncrementalAuthorizationRouterData>
                 capture: None,
                 capture_options: None,
                 payment_solution: None,
+                cavv_algorithm,
             },
             order_information: OrderInformationIncrementalAuthorization {
                 amount_details: AdditionalAmount {
diff --git a/crates/hyperswitch_connectors/src/connectors/gpayments.rs b/crates/hyperswitch_connectors/src/connectors/gpayments.rs
index 946879d8b72..945852cf7a1 100644
--- a/crates/hyperswitch_connectors/src/connectors/gpayments.rs
+++ b/crates/hyperswitch_connectors/src/connectors/gpayments.rs
@@ -394,6 +394,8 @@ impl
                 trans_status: response.trans_status.into(),
                 authentication_value: response.authentication_value,
                 eci: response.eci,
+                challenge_cancel: None,
+                challenge_code_reason: None,
             }),
             ..data.clone()
         })
diff --git a/crates/hyperswitch_connectors/src/connectors/gpayments/transformers.rs b/crates/hyperswitch_connectors/src/connectors/gpayments/transformers.rs
index b35679bd998..11f58d278a4 100644
--- a/crates/hyperswitch_connectors/src/connectors/gpayments/transformers.rs
+++ b/crates/hyperswitch_connectors/src/connectors/gpayments/transformers.rs
@@ -295,6 +295,10 @@ impl
                 ds_trans_id: Some(response_auth.ds_trans_id),
                 connector_metadata: None,
                 eci: None,
+                challenge_code: None,
+                challenge_cancel: None,
+                challenge_code_reason: None,
+                message_extension: None,
             });
         Ok(Self {
             response,
diff --git a/crates/hyperswitch_connectors/src/connectors/netcetera.rs b/crates/hyperswitch_connectors/src/connectors/netcetera.rs
index 36fa194ca1b..a2745dc4b08 100644
--- a/crates/hyperswitch_connectors/src/connectors/netcetera.rs
+++ b/crates/hyperswitch_connectors/src/connectors/netcetera.rs
@@ -220,6 +220,8 @@ impl IncomingWebhook for Netcetera {
                 .unwrap_or(common_enums::TransactionStatus::InformationOnly),
             authentication_value: webhook_body.authentication_value,
             eci: webhook_body.eci,
+            challenge_cancel: webhook_body.challenge_cancel,
+            challenge_code_reason: webhook_body.trans_status_reason,
         })
     }
 }
diff --git a/crates/hyperswitch_connectors/src/connectors/netcetera/netcetera_types.rs b/crates/hyperswitch_connectors/src/connectors/netcetera/netcetera_types.rs
index 7cd34ec9371..c0691c5ffdf 100644
--- a/crates/hyperswitch_connectors/src/connectors/netcetera/netcetera_types.rs
+++ b/crates/hyperswitch_connectors/src/connectors/netcetera/netcetera_types.rs
@@ -1713,15 +1713,6 @@ pub struct SplitSdkType {
     limited_ind: Option<String>,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone)]
-#[serde(rename_all = "camelCase")]
-pub struct MessageExtensionAttribute {
-    id: String,
-    name: String,
-    criticality_indicator: bool,
-    data: String,
-}
-
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub enum ThreeDSReqAuthMethod {
     /// No 3DS Requestor authentication occurred (i.e. cardholder "logged in" as guest)
diff --git a/crates/hyperswitch_connectors/src/connectors/netcetera/transformers.rs b/crates/hyperswitch_connectors/src/connectors/netcetera/transformers.rs
index 37238722b72..fc334d68167 100644
--- a/crates/hyperswitch_connectors/src/connectors/netcetera/transformers.rs
+++ b/crates/hyperswitch_connectors/src/connectors/netcetera/transformers.rs
@@ -5,7 +5,8 @@ use hyperswitch_domain_models::{
     router_data::{ConnectorAuthType, ErrorResponse},
     router_flow_types::authentication::{Authentication, PreAuthentication},
     router_request_types::authentication::{
-        AuthNFlowType, ChallengeParams, ConnectorAuthenticationRequestData, PreAuthNRequestData,
+        AuthNFlowType, ChallengeParams, ConnectorAuthenticationRequestData,
+        MessageExtensionAttribute, PreAuthNRequestData,
     },
     router_response_types::AuthenticationResponseData,
 };
@@ -164,6 +165,21 @@ impl
                     connector_metadata: None,
                     ds_trans_id: response.authentication_response.ds_trans_id,
                     eci: response.eci,
+                    challenge_code: response.three_ds_requestor_challenge_ind,
+                    challenge_cancel: response.challenge_cancel,
+                    challenge_code_reason: response.trans_status_reason,
+                    message_extension: response.message_extension.and_then(|v| {
+                        match serde_json::to_value(&v) {
+                            Ok(val) => Some(Secret::new(val)),
+                            Err(e) => {
+                                router_env::logger::error!(
+                                    "Failed to serialize message_extension: {:?}",
+                                    e
+                                );
+                                None
+                            }
+                        }
+                    }),
                 })
             }
             NetceteraAuthenticationResponse::Error(error_response) => Err(ErrorResponse {
@@ -432,8 +448,8 @@ pub struct NetceteraAuthenticationRequest {
     pub merchant: Option<netcetera_types::MerchantData>,
     pub broad_info: Option<String>,
     pub device_render_options: Option<netcetera_types::DeviceRenderingOptionsSupported>,
-    pub message_extension: Option<Vec<netcetera_types::MessageExtensionAttribute>>,
-    pub challenge_message_extension: Option<Vec<netcetera_types::MessageExtensionAttribute>>,
+    pub message_extension: Option<Vec<MessageExtensionAttribute>>,
+    pub challenge_message_extension: Option<Vec<MessageExtensionAttribute>>,
     pub browser_information: Option<netcetera_types::Browser>,
     #[serde(rename = "threeRIInd")]
     pub three_ri_ind: Option<String>,
@@ -640,6 +656,11 @@ pub struct NetceteraAuthenticationSuccessResponse {
     pub authentication_response: AuthenticationResponse,
     #[serde(rename = "base64EncodedChallengeRequest")]
     pub encoded_challenge_request: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub trans_status_reason: Option<String>,
+    #[serde(rename = "threeDSRequestorChallengeInd")]
+    pub three_ds_requestor_challenge_ind: Option<String>,
+    pub message_extension: Option<Vec<MessageExtensionAttribute>>,
 }
 
 #[derive(Debug, Deserialize, Serialize)]
@@ -708,4 +729,6 @@ pub struct ResultsResponseData {
 
     /// Optional object containing error details if any errors occurred during the process.
     pub error_details: Option<NetceteraErrorDetails>,
+    pub challenge_cancel: Option<String>,
+    pub trans_status_reason: Option<String>,
 }
diff --git a/crates/hyperswitch_connectors/src/connectors/nuvei/transformers.rs b/crates/hyperswitch_connectors/src/connectors/nuvei/transformers.rs
index b68ecb83f30..31833475db3 100644
--- a/crates/hyperswitch_connectors/src/connectors/nuvei/transformers.rs
+++ b/crates/hyperswitch_connectors/src/connectors/nuvei/transformers.rs
@@ -20,7 +20,8 @@ use hyperswitch_domain_models::{
         Authorize, Capture, CompleteAuthorize, PSync, Void,
     },
     router_request_types::{
-        BrowserInformation, PaymentsAuthorizeData, PaymentsPreProcessingData, ResponseId,
+        authentication::MessageExtensionAttribute, BrowserInformation, PaymentsAuthorizeData,
+        PaymentsPreProcessingData, ResponseId,
     },
     router_response_types::{
         MandateReference, PaymentsResponseData, RedirectForm, RefundsResponseData,
@@ -501,26 +502,10 @@ pub struct NuveiACSResponse {
     pub message_type: String,
     pub message_version: String,
     pub trans_status: Option<LiabilityShift>,
-    pub message_extension: Vec<MessageExtension>,
+    pub message_extension: Vec<MessageExtensionAttribute>,
     pub acs_signed_content: Option<serde_json::Value>,
 }
 
-#[derive(Debug, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MessageExtension {
-    pub name: String,
-    pub id: String,
-    pub criticality_indicator: bool,
-    pub data: MessageExtensionData,
-}
-
-#[derive(Debug, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MessageExtensionData {
-    pub value_one: String,
-    pub value_two: String,
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub enum LiabilityShift {
     #[serde(rename = "Y", alias = "1")]
diff --git a/crates/hyperswitch_connectors/src/connectors/threedsecureio.rs b/crates/hyperswitch_connectors/src/connectors/threedsecureio.rs
index 7f98cf9d958..014681b7759 100644
--- a/crates/hyperswitch_connectors/src/connectors/threedsecureio.rs
+++ b/crates/hyperswitch_connectors/src/connectors/threedsecureio.rs
@@ -486,6 +486,8 @@ impl
                 trans_status: response.trans_status.into(),
                 authentication_value: response.authentication_value,
                 eci: response.eci,
+                challenge_cancel: None,
+                challenge_code_reason: None,
             }),
             ..data.clone()
         })
diff --git a/crates/hyperswitch_connectors/src/connectors/threedsecureio/transformers.rs b/crates/hyperswitch_connectors/src/connectors/threedsecureio/transformers.rs
index 82387266ed3..de34d423803 100644
--- a/crates/hyperswitch_connectors/src/connectors/threedsecureio/transformers.rs
+++ b/crates/hyperswitch_connectors/src/connectors/threedsecureio/transformers.rs
@@ -184,6 +184,10 @@ impl
                     connector_metadata: None,
                     ds_trans_id: Some(response.ds_trans_id),
                     eci: None,
+                    challenge_code: None,
+                    challenge_cancel: None,
+                    challenge_code_reason: None,
+                    message_extension: None,
                 })
             }
             ThreedsecureioAuthenticationResponse::Error(err_response) => match *err_response {
diff --git a/crates/hyperswitch_connectors/src/connectors/unified_authentication_service/transformers.rs b/crates/hyperswitch_connectors/src/connectors/unified_authentication_service/transformers.rs
index 3837daae67b..2a795422519 100644
--- a/crates/hyperswitch_connectors/src/connectors/unified_authentication_service/transformers.rs
+++ b/crates/hyperswitch_connectors/src/connectors/unified_authentication_service/transformers.rs
@@ -485,6 +485,8 @@ impl<F, T>
                             ds_trans_id: dynamic_data.ds_trans_id,
                         }),
                     trans_status: item.response.authentication_details.trans_status,
+                    challenge_cancel: None,
+                    challenge_code_reason: None,
                 },
             }),
             ..item.data
@@ -822,6 +824,10 @@ pub struct ThreeDsAuthDetails {
     pub acs_signed_content: Option<String>,
     pub authentication_value: Option<Secret<String>>,
     pub eci: Option<String>,
+    pub challenge_code: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
+    pub message_extension: Option<common_utils::pii::SecretSerdeValue>,
 }
 
 #[derive(Debug, Serialize, Clone, Copy, Deserialize)]
@@ -990,6 +996,10 @@ impl<F, T>
                         connector_metadata: None,
                         ds_trans_id: Some(auth_response.three_ds_auth_response.ds_trans_id),
                         eci: auth_response.three_ds_auth_response.eci,
+                        challenge_code: auth_response.three_ds_auth_response.challenge_code,
+                        challenge_cancel: auth_response.three_ds_auth_response.challenge_cancel,
+                        challenge_code_reason: auth_response.three_ds_auth_response.challenge_code_reason,
+                        message_extension:  auth_response.three_ds_auth_response.message_extension,
                     },
                 })
             }
diff --git a/crates/hyperswitch_domain_models/src/router_request_types.rs b/crates/hyperswitch_domain_models/src/router_request_types.rs
index 9aca1f867f9..058f3bfce3b 100644
--- a/crates/hyperswitch_domain_models/src/router_request_types.rs
+++ b/crates/hyperswitch_domain_models/src/router_request_types.rs
@@ -712,6 +712,11 @@ pub struct AuthenticationData {
     pub message_version: Option<common_utils::types::SemanticVersion>,
     pub ds_trans_id: Option<String>,
     pub created_at: time::PrimitiveDateTime,
+    pub challenge_code: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
+    pub message_extension: Option<pii::SecretSerdeValue>,
+    pub acs_trans_id: Option<String>,
     pub authentication_type: Option<common_enums::DecoupledAuthenticationType>,
 }
 
diff --git a/crates/hyperswitch_domain_models/src/router_request_types/authentication.rs b/crates/hyperswitch_domain_models/src/router_request_types/authentication.rs
index 31b0e1a46ae..a26d0c7689f 100644
--- a/crates/hyperswitch_domain_models/src/router_request_types/authentication.rs
+++ b/crates/hyperswitch_domain_models/src/router_request_types/authentication.rs
@@ -69,6 +69,15 @@ impl AuthNFlowType {
     }
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct MessageExtensionAttribute {
+    pub id: String,
+    pub name: String,
+    pub criticality_indicator: bool,
+    pub data: String,
+}
+
 #[derive(Clone, Default, Debug)]
 pub struct PreAuthNRequestData {
     // card data
diff --git a/crates/hyperswitch_domain_models/src/router_request_types/unified_authentication_service.rs b/crates/hyperswitch_domain_models/src/router_request_types/unified_authentication_service.rs
index f37af7fa6d3..4edcdb7962f 100644
--- a/crates/hyperswitch_domain_models/src/router_request_types/unified_authentication_service.rs
+++ b/crates/hyperswitch_domain_models/src/router_request_types/unified_authentication_service.rs
@@ -128,6 +128,10 @@ pub struct AuthenticationDetails {
     pub connector_metadata: Option<serde_json::Value>,
     pub ds_trans_id: Option<String>,
     pub eci: Option<String>,
+    pub challenge_code: Option<String>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
+    pub message_extension: Option<common_utils::pii::SecretSerdeValue>,
 }
 
 #[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
@@ -136,6 +140,8 @@ pub struct PostAuthenticationDetails {
     pub token_details: Option<TokenDetails>,
     pub dynamic_data_details: Option<DynamicData>,
     pub trans_status: Option<common_enums::TransactionStatus>,
+    pub challenge_cancel: Option<String>,
+    pub challenge_code_reason: Option<String>,
 }
 
 #[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
diff --git a/crates/hyperswitch_domain_models/src/router_response_types.rs b/crates/hyperswitch_domain_models/src/router_response_types.rs
index dc9d11b0323..b5181dee31e 100644
--- a/crates/hyperswitch_domain_models/src/router_response_types.rs
+++ b/crates/hyperswitch_domain_models/src/router_response_types.rs
@@ -3,7 +3,7 @@ pub mod fraud_check;
 pub mod revenue_recovery;
 use std::collections::HashMap;
 
-use common_utils::{request::Method, types::MinorUnit};
+use common_utils::{pii, request::Method, types::MinorUnit};
 pub use disputes::{AcceptDisputeResponse, DefendDisputeResponse, SubmitEvidenceResponse};
 
 use crate::{
@@ -91,7 +91,7 @@ pub struct TaxCalculationResponseData {
 pub struct MandateReference {
     pub connector_mandate_id: Option<String>,
     pub payment_method_id: Option<String>,
-    pub mandate_metadata: Option<common_utils::pii::SecretSerdeValue>,
+    pub mandate_metadata: Option<pii::SecretSerdeValue>,
     pub connector_mandate_request_reference_id: Option<String>,
 }
 
@@ -546,18 +546,24 @@ pub enum AuthenticationResponseData {
         connector_metadata: Option<serde_json::Value>,
         ds_trans_id: Option<String>,
         eci: Option<String>,
+        challenge_code: Option<String>,
+        challenge_cancel: Option<String>,
+        challenge_code_reason: Option<String>,
+        message_extension: Option<pii::SecretSerdeValue>,
     },
     PostAuthNResponse {
         trans_status: common_enums::TransactionStatus,
         authentication_value: Option<masking::Secret<String>>,
         eci: Option<String>,
+        challenge_cancel: Option<String>,
+        challenge_code_reason: Option<String>,
     },
 }
 
 #[derive(Debug, Clone)]
 pub struct CompleteAuthorizeRedirectResponse {
     pub params: Option<masking::Secret<String>>,
-    pub payload: Option<common_utils::pii::SecretSerdeValue>,
+    pub payload: Option<pii::SecretSerdeValue>,
 }
 
 /// Represents details of a payment method.
diff --git a/crates/hyperswitch_interfaces/src/authentication.rs b/crates/hyperswitch_interfaces/src/authentication.rs
index 6c2488767b2..cdde955e5ef 100644
--- a/crates/hyperswitch_interfaces/src/authentication.rs
+++ b/crates/hyperswitch_interfaces/src/authentication.rs
@@ -9,4 +9,8 @@ pub struct ExternalAuthenticationPayload {
     pub authentication_value: Option<masking::Secret<String>>,
     /// eci
     pub eci: Option<String>,
+    /// Indicates whether the challenge was canceled by the user or system.
+    pub challenge_cancel: Option<String>,
+    /// Reason for the challenge code, if applicable.
+    pub challenge_code_reason: Option<String>,
 }
diff --git a/crates/router/src/core/authentication/utils.rs b/crates/router/src/core/authentication/utils.rs
index b6c304168c0..e1f9b02c881 100644
--- a/crates/router/src/core/authentication/utils.rs
+++ b/crates/router/src/core/authentication/utils.rs
@@ -100,6 +100,10 @@ pub async fn update_trackers<F: Clone, Req>(
                 connector_metadata,
                 ds_trans_id,
                 eci,
+                challenge_code,
+                challenge_cancel,
+                challenge_code_reason,
+                message_extension,
             } => {
                 authentication_value
                     .async_map(|auth_val| {
@@ -132,12 +136,18 @@ pub async fn update_trackers<F: Clone, Req>(
                     connector_metadata,
                     ds_trans_id,
                     eci,
+                    challenge_code,
+                    challenge_cancel,
+                    challenge_code_reason,
+                    message_extension,
                 }
             }
             AuthenticationResponseData::PostAuthNResponse {
                 trans_status,
                 authentication_value,
                 eci,
+                challenge_cancel,
+                challenge_code_reason,
             } => {
                 authentication_value
                     .async_map(|auth_val| {
@@ -160,6 +170,8 @@ pub async fn update_trackers<F: Clone, Req>(
                     ),
                     trans_status,
                     eci,
+                    challenge_cancel,
+                    challenge_code_reason,
                 }
             }
             AuthenticationResponseData::PreAuthVersionCallResponse {
@@ -284,6 +296,10 @@ pub async fn create_new_authentication(
         browser_info: None,
         email: None,
         profile_acquirer_id: None,
+        challenge_code: None,
+        challenge_cancel: None,
+        challenge_code_reason: None,
+        message_extension: None,
     };
     state
         .store
diff --git a/crates/router/src/core/payments/types.rs b/crates/router/src/core/payments/types.rs
index 10df4034c92..2abdfdc8ee6 100644
--- a/crates/router/src/core/payments/types.rs
+++ b/crates/router/src/core/payments/types.rs
@@ -391,6 +391,11 @@ impl
                 message_version,
                 ds_trans_id: authentication.ds_trans_id.clone(),
                 authentication_type: authentication.authentication_type,
+                challenge_code: authentication.challenge_code.clone(),
+                challenge_cancel: authentication.challenge_cancel.clone(),
+                challenge_code_reason: authentication.challenge_code_reason.clone(),
+                message_extension: authentication.message_extension.clone(),
+                acs_trans_id: authentication.acs_trans_id.clone(),
             })
         } else {
             Err(errors::ApiErrorResponse::PaymentAuthenticationFailed { data: None }.into())
diff --git a/crates/router/src/core/unified_authentication_service.rs b/crates/router/src/core/unified_authentication_service.rs
index 91d56f4de1c..a7690fc2923 100644
--- a/crates/router/src/core/unified_authentication_service.rs
+++ b/crates/router/src/core/unified_authentication_service.rs
@@ -609,6 +609,10 @@ pub async fn create_new_authentication(
         browser_info: None,
         email: None,
         profile_acquirer_id,
+        challenge_code: None,
+        challenge_cancel: None,
+        challenge_code_reason: None,
+        message_extension: None,
     };
     state
         .store
diff --git a/crates/router/src/core/unified_authentication_service/utils.rs b/crates/router/src/core/unified_authentication_service/utils.rs
index 954e33f76b5..3f19b82d075 100644
--- a/crates/router/src/core/unified_authentication_service/utils.rs
+++ b/crates/router/src/core/unified_authentication_service/utils.rs
@@ -235,6 +235,10 @@ pub async fn external_authentication_update_trackers<F: Clone, Req>(
                         connector_metadata: authentication_details.connector_metadata,
                         ds_trans_id: authentication_details.ds_trans_id,
                         eci: authentication_details.eci,
+                        challenge_code: authentication_details.challenge_code,
+                        challenge_cancel: authentication_details.challenge_cancel,
+                        challenge_code_reason: authentication_details.challenge_code_reason,
+                        message_extension: authentication_details.message_extension,
                     },
                 )
             }
@@ -271,6 +275,8 @@ pub async fn external_authentication_update_trackers<F: Clone, Req>(
                         ),
                         trans_status,
                         eci: authentication_details.eci,
+                        challenge_cancel: authentication_details.challenge_cancel,
+                        challenge_code_reason: authentication_details.challenge_code_reason,
                     },
                 )
             }
diff --git a/crates/router/src/core/webhooks/incoming.rs b/crates/router/src/core/webhooks/incoming.rs
index cc1dc7bc506..71d13813310 100644
--- a/crates/router/src/core/webhooks/incoming.rs
+++ b/crates/router/src/core/webhooks/incoming.rs
@@ -1400,6 +1400,8 @@ async fn external_authentication_incoming_webhook_flow(
             ),
             trans_status,
             eci: authentication_details.eci,
+            challenge_cancel: authentication_details.challenge_cancel,
+            challenge_code_reason: authentication_details.challenge_code_reason,
         };
         let authentication =
             if let webhooks::ObjectReferenceId::ExternalAuthenticationID(authentication_id_type) =
diff --git a/crates/router/src/db/authentication.rs b/crates/router/src/db/authentication.rs
index cc892cc513a..74600d4284e 100644
--- a/crates/router/src/db/authentication.rs
+++ b/crates/router/src/db/authentication.rs
@@ -168,6 +168,10 @@ impl AuthenticationInterface for MockDb {
             browser_info: authentication.browser_info,
             email: authentication.email,
             profile_acquirer_id: authentication.profile_acquirer_id,
+            challenge_code: authentication.challenge_code,
+            challenge_cancel: authentication.challenge_cancel,
+            challenge_code_reason: authentication.challenge_code_reason,
+            message_extension: authentication.message_extension,
         };
         authentications.push(authentication.clone());
         Ok(authentication)
diff --git a/migrations/2025-07-25-115018_add_authn_fields_challenge_code_cancel_reason_message_extension/down.sql b/migrations/2025-07-25-115018_add_authn_fields_challenge_code_cancel_reason_message_extension/down.sql
new file mode 100644
index 00000000000..a0c12177640
--- /dev/null
+++ b/migrations/2025-07-25-115018_add_authn_fields_challenge_code_cancel_reason_message_extension/down.sql
@@ -0,0 +1,5 @@
+ALTER TABLE authentication
+    DROP COLUMN IF EXISTS challenge_code,
+    DROP COLUMN IF EXISTS challenge_cancel,
+    DROP COLUMN IF EXISTS challenge_code_reason,
+    DROP COLUMN IF EXISTS message_extension;
\ No newline at end of file
diff --git a/migrations/2025-07-25-115018_add_authn_fields_challenge_code_cancel_reason_message_extension/up.sql b/migrations/2025-07-25-115018_add_authn_fields_challenge_code_cancel_reason_message_extension/up.sql
new file mode 100644
index 00000000000..beed7efa399
--- /dev/null
+++ b/migrations/2025-07-25-115018_add_authn_fields_challenge_code_cancel_reason_message_extension/up.sql
@@ -0,0 +1,5 @@
+ALTER TABLE authentication
+    ADD COLUMN challenge_code VARCHAR NULL,
+    ADD COLUMN challenge_cancel VARCHAR NULL,
+    ADD COLUMN challenge_code_reason VARCHAR NULL,
+    ADD COLUMN message_extension JSONB NULL;