Vulnerability · Published Oct 16, 2025 · Assigned by WSO2
CVE-2025-9152Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
Critical 9.8
In plain English
A critical-severity missing authentication in WSO2 API Control Plane from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 – before 3.2.0.4373.2.1 – before 3.2.1.574.0.0 – before 4.0.0.3574.1.0 – before 4.1.0.2214.2.0 – before 4.2.0.1594.3.0 – before 4.3.0.724.4.0 – before 4.4.0.35 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – before 4.5.0.20 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H