# CVE-2025-7043: WSO2 API Manager refresh token validation bypass

Source: https://junglewise.ai/threats/cve-2025-7043-the-forgerock-client-fails-to-correctly-validate-refresh-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2025-7043 · Severity: medium · CVSS 5.4 · Published 2026-10-19

WSO2 API Manager is a platform for managing APIs and controlling access to backend services. A flaw in how the system validates refresh tokens allows an attacker who obtains a stolen or exposed refresh token to use it directly to access protected resources, bypassing the requirement for client credentials. This could lead to unauthorized access to APIs and the data they protect.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2025-7043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7043 being exploited in the wild.

**How severe is CVE-2025-7043?** Medium severity, with a CVSS score of 5.4, published 19 October 2026.

**Which products and versions are affected?** Wso2 API Control Plane 4.5.0; Wso2 API Manager 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 3.2.1, 3.2.0; Wso2 Universal Gateway 4.5.0.

**Is there a fix for CVE-2025-7043?** Yes: fixed in WSO2 API Manager: 4.5.0 (Update 12 or 14), 4.4.0 (Update 28 or 30), 4.3.0 (Update 65 or 67), 4.2.0 (Update 156), 4.1.0 (Update 218), 3.2.1 (Update 52 or 54), 3.2.0 (Update 432 or 434); WSO2 API Control Plane: 4.5.0 (Update 13 or 15); WSO2 Universal Gateway: 4.5.0 (Update 12 or 14). Until then: Apply the relevant security update for your product version, or apply the public fix from https://github.com/wso2-extensions/apim-km-forgerock/pull/13 for open-source installations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-7043 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-7043?** Check whether you run Wso2 API Control Plane, Wso2 API Manager or Wso2 Universal Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WSO2 API Manager: 4.5.0 (Update 12 or 14), 4.4.0 (Update 28 or 30), 4.3.0 (Update 65 or 67), 4.2.0 (Update 156), 4.1.0 (Update 218), 3.2.1 (Update 52 or 54), 3.2.0 (Update 432 or 434); WSO2 API Control Plane: 4.5.0 (Update 13 or 15); WSO2 Universal Gateway: 4.5.0 (Update 12 or 14)

Apply the relevant security update for your product version, or apply the public fix from https://github.com/wso2-extensions/apim-km-forgerock/pull/13 for open-source installations.

## Technical details

The ForgeRock client in WSO2 API Manager fails to properly validate refresh tokens, allowing them to be treated as valid access tokens. An attacker with a stolen refresh token can use it to consume protected resources without needing valid client credentials, which normally are required to exchange a refresh token for an access token. This is a token validation bypass affecting the OAuth2 flow.

## Affected products

- WSO2 API Manager 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 3.2.1, 3.2.0
- WSO2 API Control Plane 4.5.0
- WSO2 Universal Gateway 4.5.0

## Timeline

- 2026-01-26: disclosed

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)