org.wso2.km.ext.forgerock:forgerock.key.manager vulnerabilities

CVEs whose affected-version data names the org.wso2.km.ext.forgerock:forgerock.key.manager package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-7043Medium· 5.4

today

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requ…

▾ SunlitWSO2 · WSO2 API Managervia CVEORG