Researcher Details Critical Authentication Bypasses in WSO2 API Manager and Identity Server

SecurityOnline[.]info reports that security researcher Crnkovic disclosed three critical vulnerabilities—CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804—in WSO2 API Manager and WSO2 Identity Server, each scoring 9.8 on the CVSS scale. The flaws stem from flawed regex-based access control configuration, with permissions and endpoint protection rules defined separately from application logic, enabling unauthenticated remote attackers to obtain administrator privileges and, in some cases, execute arbitrary code.

The first flaw affects WSO2 API Manager 3.2.0 and later and involves missing or poorly written regular expressions in identity.xml, with the most serious case involving the endpoint /keymanager-operations/dcr/register/<client_id> that leaks OAuth client secrets and allows unauthenticated client registration or modification.

The second flaw covers a bypass based on HTTP method case sensitivity and path normalization in the authentication logic, and the third impacts older API Manager versions via the SOAP-based APIKeyMgtSubscriberService endpoint. WSO2 has patched the issues, but the researcher warns that regex-based access control remains a high-risk pattern for defenders and developers alike.