Skip to content
Fencer Vulns
medium 5.4

CVE-2025-7043 json

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

published 2026-10-19 20 d ago modified 2026-11-04 4 d ago also EUVD-2025-211116

cvss
5.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.

An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

Patch / fix

  • WSO2 WSO2 API Manager 3.2.0.434, 3.2.1.54, 4.1.0.218, 4.2.0.156, 4.3.0.67, 4.4.0.30, 4.5.0.14
  • WSO2 WSO2 Universal Gateway 4.5.0.14
  • WSO2 WSO2 API Control Plane 4.5.0.15
  • WSO2 Forgerock Key Manager Component 1.0.0.3, 1.0.0.4, 1.1.0.2, 1.1.5.3, 1.1.5.4

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11 d ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Universal Gateway
  • WSO2 WSO2 API Control Plane
  • WSO2 Forgerock Key Manager Component

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.