PT-2025-42462 · Wso2 · Wso2 Api Manager

Crnković

·

Published

2025-10-16

·

Updated

2025-10-29

·

CVE-2025-9152

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WSO2 API Manager (affected versions not specified)
Description An improper privilege management issue exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations. The affected endpoint is /keymanager-operations/DCR. The vulnerable operation involves generating access tokens. The access tokens are generated with elevated privileges.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-9152

Affected Products

Wso2 Api Manager