Vulnerability · Published Oct 19, 2026 · Assigned by WSO2
CVE-2025-7043Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
Medium 5.4
In plain English
A medium-severity missing authorization in Forgerock Key Manager Component from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 – before 3.2.0.4343.2.1 – before 3.2.1.544.1.0 – before 4.1.0.2184.2.0 – before 4.2.0.1564.3.0 – before 4.3.0.674.4.0 – before 4.4.0.304.5.0 – before 4.5.0.14 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – before 4.5.0.14 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – before 4.5.0.15 |
| WSO2 | Forgerock Key Manager Component | 1.0.0 – before 1.0.0.31.0.0 – before 1.0.0.41.1.0 – before 1.1.0.21.1.5 – before 1.1.5.31.1.5 – before 1.1.5.4 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N