Introduction
Administrative access to enterprise middleware can mean full control over sensitive data and critical systems. CVE-2025-9312 gives attackers a way to bypass mutual TLS authentication in WSO2 products, and it may grant them unauthorized administrative privileges over REST and SOAP interfaces.
WSO2 is a major open source middleware vendor with customers worldwide in banking, healthcare, government, and technology. Its products are widely used for API management, identity, and integration, so a vulnerability in their authentication mechanisms has a large impact across industries.
Technical Information
CVE-2025-9312 is a critical missing authentication enforcement vulnerability in the mutual TLS (mTLS) implementation for System REST APIs and SOAP services in multiple WSO2 products. When mTLS is enabled using default configurations, the affected components do not properly validate client certificate-based authentication and may accept unauthenticated requests. This happens in two scenarios:
- When relying on default mTLS settings for System REST APIs
- When the mTLS authenticator is enabled for SOAP services
In both cases, the system may accept requests that carry no valid client certificate, even though mTLS is enabled. An attacker with network access to the affected endpoints can then gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms, such as Mutual TLS OAuth client authentication and X.509 login flows, are not affected. Neither are APIs served through the API Gateway of WSO2 API Manager.
The root cause is that authentication checks are not properly enforced for critical administrative functions, which falls under CWE-306 (Missing Authentication for Critical Function). The attacker does not need valid credentials or certificates, and that lowers the barrier to exploitation considerably.
Affected Systems and Versions
- Multiple WSO2 products with System REST APIs and SOAP services, where mTLS is enabled using default configurations or the mTLS authenticator is enabled for SOAP services
- Only administrative interfaces (System REST APIs and SOAP services) are affected
- APIs served through the API Gateway are not affected
- Mutual TLS OAuth client authentication and X.509 login flows are not affected
- For the exact affected products and versions, see the official advisory: WSO2-2025-4494
Vendor Security History
WSO2 has had critical vulnerabilities in authentication and access control before. Notable examples include:
- CVE-2022-29464: Unauthenticated file upload leading to remote code execution
- CVE-2024-6914: SOAP admin authentication bypass allowing unauthorized password resets
WSO2 has typically responded to these issues with prompt advisories and patches, but authentication flaws keep recurring, which points to a persistent problem with endpoint security. Organizations using WSO2 should monitor its advisories and apply updates promptly.
