cbcvebase.
CVE-2025-7043
published 2026-10-19

CVE-2025-7043: The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for…

PriorityP432medium5.4CVSS 3.1
AVNACHPRNUINSCCLILAN
EPSS
0.18%
7.6th percentile
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

Affected

14 ranges
VendorProductVersion rangeFixed in
wso2forgerock_key_manager_component>= 1.0.0 < 1.0.0.31.0.0.3
wso2forgerock_key_manager_component>= 1.0.0 < 1.0.0.41.0.0.4
wso2forgerock_key_manager_component>= 1.1.0 < 1.1.0.21.1.0.2
wso2forgerock_key_manager_component>= 1.1.5 < 1.1.5.31.1.5.3
wso2forgerock_key_manager_component>= 1.1.5 < 1.1.5.41.1.5.4
wso2wso2_api_control_plane>= 4.5.0 < 4.5.0.154.5.0.15
wso2wso2_api_manager>= 3.2.0 < 3.2.0.4343.2.0.434
wso2wso2_api_manager>= 3.2.1 < 3.2.1.543.2.1.54
wso2wso2_api_manager>= 4.1.0 < 4.1.0.2184.1.0.218
wso2wso2_api_manager>= 4.2.0 < 4.2.0.1564.2.0.156
wso2wso2_api_manager>= 4.3.0 < 4.3.0.674.3.0.67
wso2wso2_api_manager>= 4.4.0 < 4.4.0.304.4.0.30
wso2wso2_api_manager>= 4.5.0 < 4.5.0.144.5.0.14
wso2wso2_universal_gateway>= 4.5.0 < 4.5.0.144.5.0.14

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.