Wso2 Identity Server Key Manager Connector Apim Km Wso2Is
Monthly
Authentication bypass in WSO2 API Manager allows a self-registered user to gain access to the product's System REST APIs when WSO2 Identity Server is configured as a Resident Key Manager with a shared database. The vendor rates this 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L because the described flow starts from a self-registered account; a token obtained from the Identity Server token endpoint is improperly honored by API Manager. Affected deployments are limited to that Resident Key Manager plus database-sharing architecture; no public exploit identified at time of analysis.
Authentication bypass in WSO2 API Manager allows a self-registered user to gain access to the product's System REST APIs when WSO2 Identity Server is configured as a Resident Key Manager with a shared database. The vendor rates this 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L because the described flow starts from a self-registered account; a token obtained from the Identity Server token endpoint is improperly honored by API Manager. Affected deployments are limited to that Resident Key Manager plus database-sharing architecture; no public exploit identified at time of analysis.