Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

The impact of CVE-2025-9312 is severe. An attacker can exploit this vulnerability to gain unauthorized access to sensitive data and functionality exposed through WSO2 API Manager's System REST APIs and SOAP services. This could include accessing API keys, configuration data, and potentially even executing arbitrary code depending on the API's functionality. The lack of authentication enforcement effectively eliminates a key security layer, allowing attackers to bypass standard access controls. This vulnerability is particularly concerning as mTLS is often implemented to provide a strong layer of security, and its circumvention significantly increases the attack surface. Successful exploitation could lead to data breaches, service disruption, and reputational damage.

Organizations heavily reliant on WSO2 API Manager for managing and securing their APIs are at significant risk. Specifically, deployments using default mTLS configurations without additional authentication layers are particularly vulnerable. Shared hosting environments where multiple tenants share the same WSO2 API Manager instance also face increased risk, as a compromise of one tenant could potentially lead to the compromise of others.

• java / server:

ps -ef | grep -i wso2

• java / server:

journalctl -u wso2-api-manager -f | grep -i "mTLS"

• generic web:

curl -I https://<wso2_api_manager_url>/system/rest/api/version  # Check for 200 OK without authentication

1. 2025-11-18Disclosure

   disclosure

1. Réservé2025-08-21
2. Publiée2025-11-18
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-9312 is to upgrade WSO2 API Manager to version 7.1.0.23 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Review and tighten access controls on System REST APIs and SOAP services, restricting access to only authorized users and systems. Implement stricter input validation and sanitization to minimize the potential impact of any successful attacks. Monitor API logs for suspicious activity, particularly requests originating from unexpected sources or lacking proper authentication headers. Consider deploying a Web Application Firewall (WAF) to filter malicious requests and enforce authentication policies. After upgrade, confirm by verifying that mTLS authentication is properly enforced by attempting to access protected APIs without a valid client certificate.