CVE-2025-11229
Received Received - Intake

Authorization Bypass in OAuth2 Client Credentials Flow

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WSO2 LLC

Description
The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls. Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2025-11229
EUVD
EUVD-2025-211250

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs when the `authorize_all_scopes` configuration in WSO2 Identity Server is enabled. It allows applications using the client credentials grant type to bypass scope authorization and obtain all API scopes, including sensitive internal and console scopes, without proper authorization. This defeats intended access controls.

Detection Guidance

Check the WSO2 Identity Server configuration file deployment.toml for the setting authorize_all_scopes. If enabled, the system is vulnerable. Verify if the setting authorize_internal_scopes is present and set to false.

Impact Analysis

Exploitation can lead to privilege escalation where unprivileged clients perform unauthorized administrative actions, access confidential data, or achieve full account takeover. This is possible if the vulnerable configuration is enabled in affected WSO2 Identity Server versions.

Mitigation Strategies

Set authorize_all_scopes to false in deployment.toml. If already enabled, apply the public patch from WSO2 GitHub. For subscribers, update to U2 for version 7.1.0 or U125 for version 7.0.0. Add authorize_internal_scopes = false to prevent internal scope grants.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...