CVE-2025-9312
CVE-2025-9312 is a critical-severity vulnerability in Wso2 Api Control Plane with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 0% (13th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-197988
- Weakness: CWE-306
- Affected product: Wso2 Api Control Plane
- Published:
- Last modified:
Description
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected.
Frequently asked questions
- What is CVE-2025-9312?
- A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected.
- How severe is CVE-2025-9312?
- CVE-2025-9312 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-9312 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-9312?
- CVE-2025-9312 primarily affects Wso2 Api Control Plane. In total, 44 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2025-9312?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2025-9312 have an EU (EUVD) identifier?
- Yes. CVE-2025-9312 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-197988.
- When was CVE-2025-9312 published?
- CVE-2025-9312 was published on 2025-11-18 and last updated on 2026-06-17.
References
Affected products (44)
- cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*
More vulnerabilities in Wso2 Api Control Plane
- CVE-2025-9152 — Critical (CVSS 9.8): An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and…
- CVE-2025-10611 — Critical (CVSS 9.8): Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks…
- CVE-2025-9804 — Critical (CVSS 9.6): An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in…
- CVE-2025-13590 — Critical (CVSS 9.1): A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the…
- CVE-2025-6670 — High (CVSS 8.8): A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET…
- CVE-2025-11093 — High (CVSS 8.4): An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the…
All CVEs affecting Wso2 Api Control Plane →
Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities
- CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
- CVE-2026-50242 — Critical (CVSS 10.0): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
- CVE-2026-49257 — Critical (CVSS 10.0): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1…
- CVE-2026-46846 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
- CVE-2026-46803 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
- CVE-2026-46800 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).…
Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →