An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.
A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wso2 Multiple Products | — | Apply mitigations as referenced in the advisory. | Oct 20, 2025 | Oct 16, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub