CVE-2025-5605: WSO2 API Control Plane Auth Bypass Flaw

CVE-2025-5605 Overview

CVE-2025-5605 is an authentication bypass vulnerability affecting the Management Console across multiple WSO2 products. An attacker with network access to the console can manipulate the request URI to bypass authentication controls and reach restricted resources. Confirmed exposure is limited to memory statistics, which reveal internal system details without enabling full account compromise. The flaw is tracked under CWE-290: Authentication Bypass by Spoofing and impacts widely deployed WSO2 API Manager, Identity Server, Enterprise Integrator, and Open Banking products.

Critical Impact
Unauthenticated network attackers can access restricted Management Console resources and disclose internal memory statistics from affected WSO2 deployments.

Affected Products

WSO2 API Manager versions 3.1.0 through 4.5.0, including WSO2 API Control Plane 4.5.0, Traffic Manager 4.5.0, and Universal Gateway 4.5.0
WSO2 Identity Server versions 5.10.0 through 7.1.0, plus Identity Server as Key Manager 5.10.0
WSO2 Enterprise Integrator 6.6.0, Open Banking AM 2.0.0, and Open Banking IAM 2.0.0

Discovery Timeline

2025-10-24 - CVE-2025-5605 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5605

Vulnerability Analysis

The vulnerability resides in how the WSO2 Management Console enforces authentication on incoming HTTP requests. The console relies on URI-based routing to determine whether a resource requires authentication. Attackers can craft request URIs that the routing logic classifies as public while the underlying resource handler still returns protected data.

This mismatch between the authentication filter and the resource dispatcher produces an authentication bypass condition. The observed impact is disclosure of memory statistics from the running JVM, which exposes heap usage, thread counts, and other operational telemetry. While the flaw does not grant administrative access or credential theft, the leaked telemetry aids reconnaissance for follow-on attacks against the same host.

Root Cause

The root cause is improper enforcement of authentication decisions based on manipulable request URI components. The console trusts client-supplied path elements without normalizing them before the authentication filter evaluates access rules, aligning with CWE-290 semantics for authentication bypass by spoofing.

Attack Vector

Exploitation requires only network reachability to the Management Console. No user interaction or prior credentials are needed. An attacker issues an HTTP request with a crafted URI that satisfies the public-path check while resolving to a resource that returns memory statistics. See the WSO2 Security Advisory WSO2-2025-4115 for vendor-confirmed details.

// No verified proof-of-concept code is publicly available.
// Refer to the WSO2 advisory for reproduction details.

Detection Methods for CVE-2025-5605

Indicators of Compromise

Unauthenticated HTTP requests to the Management Console targeting memory or statistics endpoints from external or unexpected source IPs.
Anomalous URI patterns containing path traversal fragments, encoded separators, or unusual suffixes on requests to /carbon/ administrative paths.
Console access log entries returning HTTP 200 for restricted resources without a preceding authenticated session.

Detection Strategies

Enable and centralize WSO2 Carbon access logs, then alert on 200 responses to administrative resources that lack a corresponding authenticated session cookie.
Deploy web application firewall (WAF) signatures that flag manipulated URIs targeting the Management Console.
Correlate spikes in requests to statistics or JMX-related endpoints with source IPs that have never authenticated to the console.

Monitoring Recommendations

Forward WSO2 access and audit logs into a centralized SIEM for retention and correlation.
Baseline normal Management Console traffic patterns and alert on deviations, particularly from non-administrative network segments.
Monitor for reconnaissance activity following suspected disclosure events, including port scans or credential-spray attempts against the same host.

How to Mitigate CVE-2025-5605

Immediate Actions Required

Restrict network access to the WSO2 Management Console to trusted administrative networks or VPN segments only.
Apply the vendor-provided WUM updates or security patches referenced in WSO2-2025-4115.
Review Management Console access logs for prior exploitation attempts against affected versions.

Patch Information

WSO2 has published remediation guidance in the WSO2 Security Advisory WSO2-2025-4115. Administrators should apply the appropriate WUM update or upgrade to a fixed release for each affected product line, including API Manager, Identity Server, Enterprise Integrator, Open Banking, and the API Control Plane, Traffic Manager, and Universal Gateway components.

Workarounds

Block external access to the Management Console at the network perimeter until patches are applied.
Place a reverse proxy or WAF in front of the console to normalize URIs and reject requests with suspicious path manipulation.
Disable exposure of the Management Console on production gateways where administrative access is not required.

bash

# Example: restrict Management Console access via firewall rules
iptables -A INPUT -p tcp --dport 9443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9443 -j DROP