Forgerock Key Manager Component
Monthly
Refresh-token validation failure in the ForgeRock Key Manager component used by WSO2 API Manager, Universal Gateway, and API Control Plane allows a remote attacker who possesses a valid refresh token to present it as an access token and reach protected resources without completing the required client-credential exchange. The CVSS 3.1 score is 5.4 with AC:H because exploitation is gated by prior acquisition of a refresh token; no public exploit code and no CISA KEV entry are identified in the provided data.
Refresh-token validation failure in the ForgeRock Key Manager component used by WSO2 API Manager, Universal Gateway, and API Control Plane allows a remote attacker who possesses a valid refresh token to present it as an access token and reach protected resources without completing the required client-credential exchange. The CVSS 3.1 score is 5.4 with AC:H because exploitation is gated by prior acquisition of a refresh token; no public exploit code and no CISA KEV entry are identified in the provided data.