Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
En bref
Sévérité
CRITICAL 9.8
EPSS
EPSS 0.71 % · centile 53 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
WSO2
Statut NVD
Analyzed
Description
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.
A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
