{"id":"CVE-2025-7043","title":"Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption","summary":"The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requ…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"WSO2","product":"WSO2 API Manager","affected":["api_manager >= 3.2.0 < 3.2.0.434","api_manager >= 3.2.1 < 3.2.1.54","api_manager >= 4.1.0 < 4.1.0.218","api_manager >= 4.2.0 < 4.2.0.156","api_manager >= 4.3.0 < 4.3.0.67","api_manager >= 4.4.0 < 4.4.0.30","api_manager >= 4.5.0 < 4.5.0.14","universal_gateway >= 4.5.0 < 4.5.0.14","api_control_plane >= 4.5.0 < 4.5.0.15","org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.0.0 < 1.0.0.3","org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.0.0 < 1.0.0.4","org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.1.0 < 1.1.0.2","org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.1.5 < 1.1.5.3","org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.1.5 < 1.1.5.4"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T16:28:15.063Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-7043","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T17:33:42.479Z","slug":"CVE-2025-7043","body":"## Overview\n\nThe ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.\n\n## Affected\n\n- `api_manager >= 3.2.0 < 3.2.0.434`\n- `api_manager >= 3.2.1 < 3.2.1.54`\n- `api_manager >= 4.1.0 < 4.1.0.218`\n- `api_manager >= 4.2.0 < 4.2.0.156`\n- `api_manager >= 4.3.0 < 4.3.0.67`\n- `api_manager >= 4.4.0 < 4.4.0.30`\n- `api_manager >= 4.5.0 < 4.5.0.14`\n- `universal_gateway >= 4.5.0 < 4.5.0.14`\n- `api_control_plane >= 4.5.0 < 4.5.0.15`\n- `org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.0.0 < 1.0.0.3`\n- `org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.0.0 < 1.0.0.4`\n- `org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.1.0 < 1.1.0.2`\n- `org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.1.5 < 1.1.5.3`\n- `org.wso2.km.ext.forgerock:forgerock.key.manager >= 1.1.5 < 1.1.5.4`\n\n## Remediation\n\nFollow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}