CVE-2025-7043
Received Received - Intake

ForgeRock Client Refresh Token Validation Bypass

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WSO2 LLC

Description
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2025-7043
EUVD
EUVD-2025-211116

Affected Vendors & Products

Showing 14 associated CPEs
Vendor Product Version / Range
WSO2 WSO2 API Manager 3.2.0
WSO2 WSO2 API Manager 3.2.1
WSO2 WSO2 API Manager 4.1.0
WSO2 WSO2 API Manager 4.2.0
WSO2 WSO2 API Manager 4.3.0
WSO2 WSO2 API Manager 4.4.0
WSO2 WSO2 API Manager 4.5.0
WSO2 WSO2 Universal Gateway 4.5.0
WSO2 WSO2 API Control Plane 4.5.0
WSO2 Forgerock Key Manager Component 1.0.0
WSO2 Forgerock Key Manager Component 1.0.0
WSO2 Forgerock Key Manager Component 1.1.0
WSO2 Forgerock Key Manager Component 1.1.5
WSO2 Forgerock Key Manager Component 1.1.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ForgeRock client fails to correctly validate refresh tokens, allowing a refresh token to be treated as a valid access token. This bypasses the security control requiring client credentials to exchange a refresh token for an access token, enabling direct access to protected resources with just a stolen refresh token.

Detection Guidance

Detecting this vulnerability requires checking if refresh tokens are being incorrectly treated as access tokens in WSO2 products. Monitor logs for unusual token usage patterns, such as refresh tokens being used without client credentials. Inspect token validation endpoints for improper refresh token handling.

Impact Analysis

An attacker with a stolen refresh token can misuse it to access protected resources directly, bypassing authentication controls. This could lead to unauthorized access to sensitive data or systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. GDPR mandates strict protection of personal data, and unauthorized access could result in breaches. HIPAA requires safeguards for protected health information, and this flaw could expose such data.

Mitigation Strategies

Apply the provided fixes or update to the latest unaffected versions of affected WSO2 products. Community users should apply the public fix from the GitHub repository, while support subscription holders should update to specified update levels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-7043. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart