CVE-2025-5605: wso2 api_control_plane Authentication Bypass by Spoofing

Vulnerability summary

CVE-2025-5605 is a medium (CVSS 5.3) Authentication Bypass by Spoofing vulnerability in wso2 api_control_plane. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.4% of scored vulnerabilities.

Timeline

1. 24-10-2025
   PublishedVulnerability first disclosed.
2. 24-10-2025
   Last modifiedVulnerability information updated.

Description

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.