CVE-2025-9152 — CRITICAL (9.8)

Vulnerability Description

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Wso2	Api Control Plane	4.5.0
Wso2	Api Manager	3.2.0

Related Weaknesses (CWE)

CWE-306

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisorVendor Advisory

FAQ

What is CVE-2025-9152?

CVE-2025-9152 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint...

How severe is CVE-2025-9152?

CVE-2025-9152 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-9152?

Check the references section above for vendor advisories and patch information. Affected products include: Wso2 Api Control Plane, Wso2 Api Manager.