External risk intelligence

WSO2 Identity Server Resident Key Manager Authorization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-4052

WSO2 Identity Server and API Manager are commonly deployed as internet-facing identity portals, API gateways, and management services. Because this vulnerability involves the product's token endpoint and REST APIs, it is commonly accessible in typical network-exposed deployments of these products.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts specific WSO2 Identity Server configurations, potentially allowing unauthorized access to system APIs if the server is shared with WSO2 API Manager. The primary concern is to determine if your deployment matches this exact configuration.

Unauthorized API access is possible.
Understand if your WSO2 Identity Server is affected.
Confirm relevance; business impact is conditional.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by interacting with the token endpoint of a WSO2 Identity Server. If the server is configured to share a database with WSO2 API Manager, a self-registered user can obtain a token. This token can then be used to access the System REST APIs of WSO2 API Manager, potentially leading to the compromise of sensitive system information and functionality.

Publicly accessible token endpoint.
Obtain token to access System REST APIs.
Unauthorized access to API Manager.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a self-registered user to access sensitive System REST APIs in WSO2 API Manager. This exposure is only possible when WSO2 Identity Server is configured to share a database and acts as the Resident Key Manager.

System REST APIs could be exposed.
Unauthenticated access via token endpoint.
Unauthorized access to sensitive system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership of this vulnerability lies with the teams managing WSO2 Identity Server and WSO2 API Manager, particularly those responsible for the security and configuration of the Identity Server when used as a Resident Key Manager with database sharing. The first practical step is to identify all instances of this specific WSO2 configuration, confirm exposure and business criticality, and then engage the accountable owner to plan remediation.

Identity and API Management platform owners.
Verify Resident Key Manager configuration and database sharing.
Plan risk-based remediation with impacted teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WSO2 Identity Server and how is it used?

WSO2 Identity Server is an identity and access management platform used to handle authentication and authorization. In enterprise environments, it often serves as the central hub for managing user identities, issuing security tokens, and enforcing access policies across various services, including integrated API management platforms.

What does CWE-862 mean for CVE-2026-4052?

CWE-862 refers to a missing authorization vulnerability. In the context of CVE-2026-4052, it means the software fails to properly verify if a user has permission to access specific resources. As a result, a user who should not have access to System REST APIs can bypass these checks and interact with sensitive management functions.

How can a user trigger this authorization issue?

The issue is triggered when a self-registered user requests a token from the Identity Server. It does not occur in standard deployments; it specifically requires the server to be configured as a Resident Key Manager that shares a database with the WSO2 API Manager. Without this shared database configuration, the bypass path is not available.

Is my WSO2 deployment at risk if it is internal?

Halo Surface Signal indicates that these products are commonly deployed as internet-facing portals or gateways. While internal instances may have reduced risk compared to public ones, the vulnerability relies on reachability to the token endpoint. You should assess if the endpoint is reachable by untrusted users or segments within your network.

Do I need to update my WSO2 configuration immediately?

Your first step is to verify if your environment matches the vulnerable configuration. Check if your WSO2 Identity Server acts as a Resident Key Manager and shares a database with the WSO2 API Manager. If this setup exists, prioritize confirming the scope of these integrated services and coordinate with your identity team to address the authorization gap.

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.