CVE-2025-7043
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
61/100
Published: 2026-10-19
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Changed
C:
Low
I:
Low
A:
None
Description
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 < 3.2.0.434 |