CVE-2025-7043
Full vulnerability record from the local CVENow database.
Description
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
Severity
MEDIUM
CVSS score
5.4
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2026-10-19 17:16:59.993000
Last modified
2026-11-04 20:10:00.263000
View original CVE JSON
{
"id": "CVE-2025-7043",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2026-10-19T17:16:59.993",
"lastModified": "2026-11-04T20:10:00.263",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented."
},
{
"lang": "es",
"value": "El cliente de ForgeRock no valida correctamente los tokens de actualización. Esto permite que un token de actualización sea tratado como un token de acceso válido, habilitando su uso para consumir recursos protegidos. Esto produce una elusión del control de seguridad previsto que requiere credenciales de cliente válidas además de un token de actualización para obtener un nuevo token de acceso.\\n\\nUn atacante que obtenga un token de actualización robado o expuesto puede aprovechar esta vulnerabilidad para acceder directamente a recursos protegidos. Esto es posible porque se elude el flujo de seguridad estándar que requiere credenciales de cliente para intercambiar un token de actualización por un token de acceso."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.2.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.434",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.54",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.218",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.156",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.67",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.0",
"lessThan": "4.4.0.30",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.5.0",
"lessThan": "4.5.0.14",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Universal Gateway",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "4.5.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "4.5.0",
"lessThan": "4.5.0.14",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 API Control Plane",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "4.5.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "4.5.0",
"lessThan": "4.5.0.15",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "Forgerock Key Manager Component",
"defaultStatus": "unknown",
"packageName": "org.wso2.km.ext.forgerock:forgerock.key.manager",
"versions": [
{
"version": "1.0.0",
"lessThan": "1.0.0.3",
"versionType": "custom",
"status": "affected"
},
{
"version": "1.0.0",
"lessThan": "1.0.0.4",
"versionType": "custom",
"status": "affected"
},
{
"version": "1.1.0",
"lessThan": "1.1.0.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "1.1.5",
"lessThan": "1.1.5.3",
"versionType": "custom",
"status": "affected"
},
{
"version": "1.1.5",
"lessThan": "1.1.5.4",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-28T17:47:45.090560Z",
"id": "CVE-2025-7043",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
]
}