CVE-2025-9152

Published: Oct 16, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Description

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Affected (9)

Products: Wso2: Api Control Plane, Api Manager

Wso2

2 products

Api Control Plane

Api Manager

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Control Plane	Version 4.5.0
Wso2 Api Manager	Version 3.2.0
Wso2 Api Manager	Version 3.2.1
Wso2 Api Manager	Version 4.0.0
Wso2 Api Manager	Version 4.1.0
Wso2 Api Manager	Version 4.2.0
Wso2 Api Manager	Version 4.3.0
Wso2 Api Manager	Version 4.4.0
Wso2 Api Manager	Version 4.5.0

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483/

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

Vendor Advisory

Timeline

No history available yet.