Token Access Vulnerability in WSO2 Identity Server Affecting WSO2 API Manager
CVE-2026-4052

9.8CRITICAL

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Identity Server Key Manager Connector (apim-km-wso2is)
Vendor
CVE Published:
3 November 2026

What is CVE-2026-4052?

This vulnerability affects deployments where WSO2 Identity Server is set up as a Resident Key Manager, particularly when utilizing database sharing. In such configurations, self-registered users can exploit this issue to gain unauthorized access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint. This flaw could lead to potentially serious implications for access controls and data security within the API management infrastructure.

Affected Version(s)

WSO2 API Control Plane 4.5.0

WSO2 API Control Plane 4.6.0

WSO2 API Manager 4.1.0

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.