Riskcovery

CVE-2025-7043

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

State
Published
Severity
5.4 Medium
Published
Oct 19, 2026
Updated
Oct 28, 2026
Reserved
Jul 3, 2025

Read the record on cve.org

Description

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.

An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NWSO2

Weaknesses

  • CWE-862 Missing Authentication for Critical Function

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.2.0Unknown
  • 3.2.0 to before 3.2.0.434Affected
  • 3.2.1 to before 3.2.1.54Affected
  • 4.1.0 to before 4.1.0.218Affected
  • 4.2.0 to before 4.2.0.156Affected
  • 4.3.0 to before 4.3.0.67Affected
  • 4.4.0 to before 4.4.0.30Affected
  • 4.5.0 to before 4.5.0.14Affected
WSO2 Universal GatewayWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.14Affected
WSO2 API Control PlaneWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.15Affected
Forgerock Key Manager ComponentWSO2
  • 1.0.0 to before 1.0.0.3Affected
  • 1.0.0 to before 1.0.0.4Affected
  • 1.1.0 to before 1.1.0.2Affected
  • 1.1.5 to before 1.1.5.3Affected
  • 1.1.5 to before 1.1.5.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.