WSO2 API Manager EUVD-2025-211116

Exploitation requires the attacker to already possess a valid refresh token for the target - stolen, exposed in logs, leaked from a compromised OAuth client, or intercepted. The flaw is in the ForgeRock Key Manager component used by WSO2 API Manager, Universal Gateway, and API Control Plane, where the token-validation routine accepts a refresh token in place of an access token and does not enforce the client-credential exchange step. The limiting factor is the refresh-token prerequisite (reflected in CVSS AC:H): without an obtained refresh token the vulnerability cannot be triggered, so realistic risk is gated by how well refresh tokens are protected in a given deployment. No end-user interaction is required once a token is held.

This is a moderate-severity authorization flaw (CWE-862) with a vendor-assigned CVSS 3.1 base score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). The network attack vector and PR:N rating make it remotely reachable without the attacker holding legitimate client credentials, which is the core of the bug: a refresh token is wrongly accepted as an access token, circumventing the client-credential requirement. However, AC:H correctly reflects a hard precondition - the attacker must FIRST obtain a valid, stolen, or exposed refresh token, so this is not a standalone remote-unauthenticated compromise but a privilege/credential-reuse escalation that amplifies the impact of a separate token-leak event. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; there is no public exploit identified at time of analysis. The low-but-real impact ratings (C:L/I:L/A:N) with a scope change (S:C) indicate limited but cross-boundary access to protected resources rather than full system takeover. Net: a legitimate but not top-priority issue - patch in normal cycles, prioritize higher if refresh tokens are known to transit untrusted channels or are logged.

An attacker who has harvested a refresh token (e.g., from logs, a compromised client, an intercepted channel, or a prior token leak) sends it directly to a protected API endpoint as if it were an access token. Because the ForgeRock Key Manager component fails to validate the token type and does not re-require client credentials, the request is honored and the attacker reads or manipulates protected resources. No public exploit code is identified in the provided data; AC:H reflects the dependency on first obtaining a valid refresh token.