CVE-2025-9152

CVE-2025-9152 is a critical improper privilege management vulnerability affecting WSO2 API Manager and API Control Plane. The flaw stems from missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. This allows an unauthenticated attacker to generate access tokens with elevated privileges, potentially gaining administrative access and performing unauthorized operations. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with low complexity and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness among security researchers.