All vulnerabilities
CVE-2025-7043

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

WSO2 WSO2 API Manager
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.2.0.434Also 3.2.1.54, 4.1.0.218 and 10 moreCVE List
Published19 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

Show all 14 fixed versions
  • 4.5.0.14WSO2 API ManagerCVE List
  • 4.5.0.14WSO2 Universal GatewayCVE List
  • 4.5.0.15WSO2 API Control PlaneCVE List
  • 1.0.0.3Forgerock Key Manager ComponentCVE List
  • 1.0.0.4Forgerock Key Manager ComponentCVE List
  • 1.1.0.2Forgerock Key Manager ComponentCVE List
  • 1.1.5.3Forgerock Key Manager ComponentCVE List
  • 1.1.5.4Forgerock Key Manager ComponentCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.

An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

Text from CVE List

Affected versions 17

  • WSO2 API Managerunknown: all versions before 3.2.0CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.434CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.54CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.218CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.156CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.67CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.30CVE List
  • WSO2 API Manageraffected: 4.5.0 before 4.5.0.14CVE List
  • WSO2 Universal Gatewayunknown: all versions before 4.5.0CVE List
  • WSO2 Universal Gatewayaffected: 4.5.0 before 4.5.0.14CVE List
  • WSO2 API Control Planeunknown: all versions before 4.5.0CVE List
  • WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.15CVE List
  • Forgerock Key Manager Componentaffected: 1.0.0 before 1.0.0.3CVE List
  • Forgerock Key Manager Componentaffected: 1.0.0 before 1.0.0.4CVE List
  • Forgerock Key Manager Componentaffected: 1.1.0 before 1.1.0.2CVE List
  • Forgerock Key Manager Componentaffected: 1.1.5 before 1.1.5.3CVE List
  • Forgerock Key Manager Componentaffected: 1.1.5 before 1.1.5.4CVE List

References 1