CVE-2025-7043
CVE-2025-7043 · Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
CVSS 5.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
wso2 api manager
- Versions
- ≥ 0, < 3.2.0: Unknown (custom)
- ≥ 3.2.0, < 3.2.0.434: Affected (custom)
- ≥ 3.2.1, < 3.2.1.54: Affected (custom)
- ≥ 4.1.0, < 4.1.0.218: Affected (custom)
- ≥ 4.2.0, < 4.2.0.156: Affected (custom)
- ≥ 4.3.0, < 4.3.0.67: Affected (custom)
- ≥ 4.4.0, < 4.4.0.30: Affected (custom)
- ≥ 4.5.0, < 4.5.0.14: Affected (custom)
Update to 3.2.0.434; Update to 3.2.1.54; Update to 4.1.0.218; Update to 4.2.0.156; Update to 4.3.0.67; Update to 4.4.0.30; Update to 4.5.0.14
wso2 universal gateway
- Versions
- ≥ 0, < 4.5.0: Unknown (custom)
- ≥ 4.5.0, < 4.5.0.14: Affected (custom)
Update to 4.5.0.14
wso2 api control plane
- Versions
- ≥ 0, < 4.5.0: Unknown (custom)
- ≥ 4.5.0, < 4.5.0.15: Affected (custom)
Update to 4.5.0.15
forgerock key manager component
- Versions
- ≥ 1.0.0, < 1.0.0.3: Affected (custom)
- ≥ 1.0.0, < 1.0.0.4: Affected (custom)
- ≥ 1.1.0, < 1.1.0.2: Affected (custom)
- ≥ 1.1.5, < 1.1.5.3: Affected (custom)
- ≥ 1.1.5, < 1.1.5.4: Affected (custom)
Update to 1.0.0.3; Update to 1.1.0.2; Update to 1.1.5.3