Live › vulnerability › CVE-2025-7043
Go to dashboardThe ForgeRock client does not properly validate refresh tokens, so one can be presented as an access token to reach protected resources. An attacker holding a stolen or exposed refresh token can call protected APIs without the client credentials that should be required.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run a ForgeRock client library in an application that calls protected resources with OAuth refresh tokens. Exposure depends on whether refresh tokens are stored or transmitted where an attacker could obtain them. The sources do not name affected versions or packages.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.
An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
This page as .md · .json · in your agent: get_signal("CVE-2025-7043")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.