CVE-2025-9312

In default mTLS configurations for System REST APIs and after enabling mTLS authentication for SOAP services, these components improperly validate authentication based on client certificates. As a result, the interfaces accept requests without enforcing additional authentication, despite mTLS being formally enabled. The vulnerability stems from improper execution of the authentication mechanism (CWE-306 — Missing Authentication for Critical Function). A necessary condition for exploiting the flaw is network accessibility of the affected mTLS flows in a given deployment.

An attacker with network access to vulnerable endpoints can obtain administrative privileges and perform unauthorized operations on system resources, threatening the confidentiality, integrity, and availability of the entire environment.

Security patches available from the vendor should be applied in accordance with references published at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/. Until the patch is implemented, it is recommended to restrict network access to System REST APIs and SOAP endpoints at the firewall level and to verify mTLS configuration in existing deployments.

WSO2 Open Banking AM, WSO2 Open Banking KM, WSO2 Traffic Manager, WSO2 Open Banking IAM, WSO2 Identity Server — versions indicated in vendor references. The vulnerability affects only deployments where mTLS flows for System REST APIs or SOAP services are enabled and accessible. Mutual TLS OAuth mechanisms and X.509 login flows, as well as APIs served by WSO2 API Manager's API Gateway, are not vulnerable.