CVE-2025-7043: wso2 forgerock key manager component Missing Authorization
Vulnerability summary
CVE-2025-7043 is a medium (CVSS 5.4) Missing Authorization vulnerability in wso2 forgerock key manager component. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.5% of scored vulnerabilities.
Timeline
- 19-10-2026PublishedVulnerability first disclosed.
Description
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wso24 products
- forgerock key manager component≥ 1.0.0, < 1.0.0.3 | ≥ 1.0.0, < 1.0.0.4 | ≥ 1.1.0, < 1.1.0.2 | ≥ 1.1.5, < 1.1.5.3 | ≥ 1.1.5, < 1.1.5.4
- wso2 api control plane≥ 4.5.0, < 4.5.0.15
- wso2 api manager≥ 3.2.0, < 3.2.0.434 | ≥ 3.2.1, < 3.2.1.54 | ≥ 4.1.0, < 4.1.0.218 | ≥ 4.2.0, < 4.2.0.156 | ≥ 4.3.0, < 4.3.0.67 | ≥ 4.4.0, < 4.4.0.30 | ≥ 4.5.0, < 4.5.0.14
- wso2 universal gateway≥ 4.5.0, < 4.5.0.14
1 vendor · 4 products