CVE-2025-9152
Status: AnalyzedCritical (9.8)—
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.
A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.71%
- Percentile among all scored CVEs: 52
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1190Exploit Public-Facing Applicationinitial access85 % - Primary impact
T1078Valid Accountsstealth · persistence · privilege escalation · initial access90 % - Secondary impact
T1068Exploitation for Privilege Escalationprivilege escalation80 %
Red sin autenticación (AV:N/PR:N) en endpoint expuesto de DCR permite generar tokens con privilegios elevados; acceso a cuenta de admin y escalada de privilegios.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (2)
CWEs
- CWE-306
References
Raw JSON (NVD)
Show
{
"id": "CVE-2025-9152",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-9152",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-10-16T12:59:14.709557Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "3.2.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.0.437",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.1",
"lessThan": "3.2.1.57",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.0.0",
"lessThan": "4.0.0.357",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.1.0",
"lessThan": "4.1.0.221",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.0.159",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.3.0",
"lessThan": "4.3.0.72",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.4.0",
"lessThan": "4.4.0.35",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.19",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 API Control Plane",
"versions": [
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.20",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-10-16T13:15:41.840",
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483/",
"tags": [
"Vendor Advisory"
],
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.\n\nA malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations."
}
],
"lastModified": "2026-06-17T10:08:25.670",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}