The vulnerability lies in insufficient validation of refresh tokens, allowing an attacker to treat a refresh token as a valid access token. This bypasses the security control that normally requires both a valid client credential and a refresh token to obtain a new access token. As a result, any user or attacker who possesses a stolen or exposed refresh token can directly access protected resources without playing the standard OAuth exchange flow. The weakness is formally identified as CWE-862, indicating improper authorization.

WSO2 Forgerock Key Manager Component, WSO2 API Control Plane, WSO2 API Manager, and WSO2 Universal Gateway are affected. Version information is not specified in the CNA data; all current releases of these products are implicitly vulnerable until patches are applied.

The CVSS score of 5.4 indicates moderate severity, but the impact can be significant for services that rely on strict token validation. EPSS is not provided, so current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Externally exposed services that accept refresh tokens represent the likely attack surface; an attacker who obtains a valid token—through phishing, credential compromise, or a client-side leak—can misuse it to consume resources. The attack vector therefore appears to be remote, dependent on token possession rather than infrastructure compromise.