A self‑registered user can acquire a JSON Web Token from the WSO2 Identity Server token endpoint when the Identity Server is configured as a Resident Key Manager with database sharing. The token can be used to call the System REST APIs of WSO2 API Manager, allowing the attacker to access and manipulate system‑level functions that are normally restricted to administrators. This gives the attacker the ability to alter or delete APIs, modify tenant configurations, and potentially expose internal data.

Deployments that include WSO2 API Control Plane, WSO2 API Manager, and the WSO2 Identity Server Key Manager Connector (apim-km-wso2is) are impacted. The vulnerability is only present when the Identity Server operates as a Resident Key Manager with shared database access. No specific version numbers are listed, so all current releases that use this configuration are potentially affected.

The CVSS score of 9.8 indicates critical severity. The EPSS score is unavailable, but the lack of KEV listing suggests that exploitation is not yet widespread. The only prerequisite is the specific configuration of the Identity Server, making exploitation feasible for attackers who can create a self‑registered account in that environment. The impact on confidentiality, integrity, and availability is system‑wide for the impacted tenant, making this a high‑risk condition.