CVE-2025-9152

CRITICAL

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpo...

Affects 2 products across 1 vendor.

CVSS 3.19.8
EPSS0.7%
Percentile53th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-306: Missing Authentication for Critical Function

Software does not perform any authentication for functionality that requires a verified identity.

Related Attack Patterns (CAPEC)
CAPEC-12 Choosing Message Identifier
via CWE-306
CAPEC-36 Using Unpublished Interfaces or Functionality
via CWE-306
CAPEC-62 Cross Site Request Forgery
via CWE-306
CAPEC-166 Force the System to Reset Values
via CWE-306
CAPEC-216 Communication Channel Manipulation
via CWE-306

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in WSO2 API Manager allows unauthorized users to generate access tokens with elevated privileges, potentially leading to administrative access.

BSID: BS-2025-GLOBAL-034766-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-9152?
A critical vulnerability in WSO2 API Manager allows unauthorized users to generate access tokens with elevated privileges, potentially leading to administrative access.
What is the CVSS score for CVE-2025-9152?
CVE-2025-9152 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.7%.
Is CVE-2025-9152 actively exploited?
No confirmed active exploitation of CVE-2025-9152 as of 2026-10-24.
How do I remediate CVE-2025-9152?
Priority: IMMEDIATE. Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483/ PSIRT: ed10eef1-636d-4fbe-9993-6890dfa878f8
What systems are affected by CVE-2025-9152?
CVE-2025-9152 affects Wso2 Api Manager, Api Control Plane.
Vulnerability Details
CVE IDCVE-2025-9152
BSIDBS-2025-GLOBAL-034766-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-10-16
Last Modified2026-10-18
ICS Relevance15%
Weakness (CWE)
Missing Authentication for Critical Function
SourceNVD
Official Description

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the keymanager-operations Dynamic Client Registration (DCR) endpoint due to missing authentication and authorization checks, enabling a malicious user to exploit this flaw to generate access tokens with elevated privileges.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Wso2 Api Manager 3.2.0 3.2.1 4.0.0 4.1.0 4.2.0 4.3.0
+2 more4.4.0 4.5.0
Wso2 Api Control Plane 4.5.0
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: ed10eef1-636d-4fbe-9993-6890dfa878f8
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 372 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash3c1726c71968849452b49e4572de4cdb791b28df3e092ca2be94c60de01cdb2db6f9cd8887ff230a45e17d8a3c28dd2695f4ecaeea55aefd2175eb849920fcc2
Related CVEs affecting Wso2
CVE-2026-5430 10.0 The JWT authentication mechanism accepts tokens signed with algorithms other ... CVE-2026-2053 10.0 The WSO2 API Manager's message flow component, when processing WS-Addressing ... CVE-2025-10611 9.8 Due to an insufficient access control implementation in multiple WSO2 Product... CVE-2020-13226 9.8 WSO2 API Manager 3.0.0 does not properly restrict outbound network access fro... CVE-2022-29464 9.8 Certain WSO2 products allow unrestricted file upload with resultant remote co...
View all Wso2 CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →