CVE-2025-9152 – Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint

CVE ID : CVE-2025-9152

Published : Oct. 16, 2025, 1:15 p.m. | 1 hour, 25 minutes ago

Description : An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.

A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…