WSO2 API Manager CVE-2025-9152

Exploitation requires network access to the WSO2 API Manager key manager component, specifically the keymanager-operations Dynamic Client Registration (DCR) endpoint, which must be reachable by the attacker (e.g. exposed on an accessible network segment or internet-facing gateway). The core condition is that this endpoint performs no authentication or authorization checks, so no credentials, tokens, or user interaction are needed against affected versions (API Manager 3.2.0-4.5.0, API Control Plane 4.5.0). The primary limiting factor is network exposure: deployments that firewall or restrict the key manager/DCR endpoint to trusted internal hosts substantially reduce real-world reachability, and the risk is highest where the endpoint is externally exposed. Authentication requirement: unauthenticated, confirmed from the CVSS vector (PR:N).

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. All severity-defining signals align coherently: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, and CWE-306 (Missing Authentication for a Critical Function) is fully consistent with the description of absent authentication/authorization checks on the keymanager-operations DCR endpoint. The full high-impact triad (C:H/I:H/A:H) is credible because the flaw yields elevated/administrative access tokens. The one tempering signal is EPSS, which at 0.71% (53rd percentile) is modest and does not indicate mass automated exploitation activity - EPSS low despite a 9.8 CVSS likely reflects that no public exploit has been catalogued and WSO2 API Manager is enterprise rather than mass-internet software, not that the flaw is hard to exploit. There is no CISA KEV listing and no POC flag in the provided data, so active exploitation is NOT confirmed. Net: a critical, trivially-exploitable auth bypass in an internet-facing API gateway component that should be patched urgently despite the currently low EPSS, because the technical preconditions for reliable exploitation are minimal.

An attacker with network reach to the WSO2 API Manager key manager interface sends unauthenticated requests to the Dynamic Client Registration (keymanager-operations/DCR) endpoint, which lacks authentication and authorization checks. By registering a client and obtaining access tokens scoped with elevated privileges, the attacker escalates to administrative access and performs unauthorized operations against the API platform. No public exploit code is identified in the provided data, but the low attack complexity makes weaponization straightforward.