CVE-2025-7043: CWE-862: Missing Authentication for Critical Function in WSO2 WSO2 API Manager

The vulnerability identified as CVE-2025-7043 in WSO2 API Manager involves improper validation of refresh tokens by the ForgeRock client. Normally, exchanging a refresh token for a new access token requires valid client credentials. However, due to this flaw, the refresh token can be accepted as a valid access token directly, circumventing the intended security control. This allows an attacker who has obtained a refresh token to access protected resources without needing the client credentials. The issue impacts versions of WSO2 API Manager from 1.0.0 up to but excluding various patch versions (e.g., <1.0.0.3, <3.2.0.434, <4.5.0.15, etc.). No known exploits in the wild have been reported, and the CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker who obtains a stolen or exposed refresh token can bypass the normal security flow that requires client credentials to exchange the refresh token for a new access token. This allows unauthorized direct access to protected resources, potentially leading to information disclosure and integrity loss. Availability is not impacted. The vulnerability is rated medium severity with a CVSS score of 5.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor WSO2 advisories for updates. Until a fix is available, restrict exposure of refresh tokens and consider additional compensating controls to protect token confidentiality.