Introduction
A critical flaw in the Dynamic Client Registration (DCR) endpoint of WSO2 API Manager gives attackers a path to administrative access. Unauthenticated users can generate access tokens with elevated privileges and bypass all intended security controls. For organizations that rely on WSO2 API Manager to secure APIs in banking, healthcare, or government, the risk is immediate and severe.
WSO2 is a major open-source middleware vendor, and its API Manager is widely adopted for API lifecycle management, security, and integration. Thousands of enterprises around the world run digital infrastructure on WSO2 technology, so a vulnerability in one of its core components has a wide impact.
Technical Information
CVE-2025-9152 is a critical improper privilege management vulnerability (CWE-269) in the keymanager-operations Dynamic Client Registration (DCR) endpoint of WSO2 API Manager. The DCR endpoint exists so that OAuth clients can be registered programmatically, which automated and scalable API integrations depend on.
The cause is missing authentication and authorization checks on the DCR endpoint. The endpoint does not verify who is making the request, and it does not restrict who can register new OAuth clients. Any remote attacker can therefore send a crafted HTTP POST request to the endpoint with arbitrary client metadata, such as scopes, grant types, and redirect URIs. The endpoint processes the request without validation and issues OAuth client credentials.
With those credentials, the attacker can request access tokens from the API Manager's token endpoint. Because the registration process lets the attacker specify privileged scopes or grant types, the resulting tokens may grant administrative or otherwise unauthorized access to API management functions. This makes a full compromise of the API management environment possible. The attacker can modify API configurations, access sensitive data, and disrupt service operations.
No public code snippets or proof-of-concept exploit are available at this time. The attack needs only remote network access, with no prior authentication and no user interaction.
Affected Systems and Versions
The vulnerability affects WSO2 API Manager. The available advisory and CVE entry do not list the specific affected versions. Organizations should check the official WSO2 Security Advisory WSO2-2025-4483 for up-to-date information on affected version ranges and fixed releases.
Vendor Security History
WSO2 API Manager and related WSO2 products have had critical vulnerabilities before. CVE-2022-29464 allowed unauthenticated remote code execution through unrestricted file upload, and it also came from missing authentication and authorization checks. Attackers exploited it in the wild quickly and used it to deploy web shells and cryptocurrency miners. WSO2 typically issues advisories and patches promptly, but the repeated privilege management flaws point to ongoing problems with how its endpoints are secured.
