CVE-2026-4052
Received Received - Intake

WSO2 Identity Server Token Access Bypass

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: WSO2 LLC

Description
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-4052
EUVD
EUVD-2026-115721

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WSO2 Identity Server when configured as a Resident Key Manager with shared databases. A self-registered user can exploit it to gain access to WSO2 API Manager's System REST APIs by obtaining a token from the Identity Server, potentially leading to administrative privileges.

Detection Guidance

Check if WSO2 Identity Server is configured as a Resident Key Manager with shared databases. Verify if self-registered users can access WSO2 API Manager's System REST APIs via tokens from Identity Server. Review logs for unauthorized API access attempts or token requests from unexpected sources.

Impact Analysis

Exploitation could result in full administrative account takeover, allowing attackers to gain unauthorized access to sensitive system APIs and perform privileged actions within the WSO2 environment.

Mitigation Strategies
  • Update WSO2 Identity Server and API Manager to their latest U2 versions.
  • Update the WSO2 IS Connector.
  • Replace specific JAR files in the dropins directory.
  • Remove the keymanager-operations.war file and directory.
  • Add the latest keymanager-operations.war file.
  • Restart WSO2 Identity Server deployments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...