ForgeRock OIDC Client Refresh-Token -> Access Token Exploit
CVE-2025-7043 Published on October 19, 2026
Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.
An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
Vulnerability Analysis
CVE-2025-7043 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2025-7043 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2025-7043
Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.
Affected Versions
WSO2 API Manager:- Before 3.2.0 is unknown.
- Version 3.2.0 and below 3.2.0.434 is affected.
- Version 3.2.1 and below 3.2.1.54 is affected.
- Version 4.1.0 and below 4.1.0.218 is affected.
- Version 4.2.0 and below 4.2.0.156 is affected.
- Version 4.3.0 and below 4.3.0.67 is affected.
- Version 4.4.0 and below 4.4.0.30 is affected.
- Version 4.5.0 and below 4.5.0.14 is affected.
- Before 4.5.0 is unknown.
- Version 4.5.0 and below 4.5.0.14 is affected.
- Before 4.5.0 is unknown.
- Version 4.5.0 and below 4.5.0.15 is affected.
- Version 1.0.0 and below 1.0.0.3 is affected.
- Version 1.0.0 and below 1.0.0.4 is affected.
- Version 1.1.0 and below 1.1.0.2 is affected.
- Version 1.1.5 and below 1.1.5.3 is affected.
- Version 1.1.5 and below 1.1.5.4 is affected.