CVE-2025-9152

CriticalCVSS 9.8

Published: 16/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.71%

53th percentile - higher than 53% of all known CVEs

Summary

WSO2 API Manager has an improper privilege management vulnerability due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this to generate access tokens with elevated privileges, potentially leading to administrative access.

Risk Assessment

The ability to generate elevated-privilege tokens risks administrative takeover of the API Manager and execution of unauthorized operations.

Recommendation

Apply vendor-provided patches and verify and restrict access to the keymanager-operations DCR endpoint.

Other vulnerabilities in WSO2 API Manager

CVE-2024-4989Medium
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages, which can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks.

Original NVD description (English source)

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS