{"id":"CVE-2025-7043","kind":"vulnerability","aliases":["CVE-2025-7043"],"related":[],"title":"ForgeRock client accepts refresh tokens as valid access tokens","description":"The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.","summary":"The ForgeRock client does not properly validate refresh tokens, so one can be presented as an access token to reach protected resources. An attacker holding a stolen or exposed refresh token can call protected APIs without the client credentials that should be required.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forgerock","identity","oauth","package"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T17:16:59+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:44+00:00","updated_at":"2026-10-25T04:16:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:16:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"ForgeRock client accepts refresh tokens as valid access tokens","impact":"medium","summary":"The ForgeRock client does not properly validate refresh tokens, so one can be presented as an access token to reach protected resources. An attacker holding a stolen or exposed refresh token can call protected APIs without the client credentials that should be required.","category":"package","nicknames":[],"who_cares":["forgerock","oauth","identity"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker reads protected resources using a stolen refresh token","analyst_note":"Find affected ForgeRock client packages, versions and fixed releases from the NVD entry and vendor advisory.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run a ForgeRock client library in an application that calls protected resources with OAuth refresh tokens. Exposure depends on whether refresh tokens are stored or transmitted where an attacker could obtain them. The sources do not name affected versions or packages.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000547,"input_tokens":3372,"output_tokens":420,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-7043':12A,15A 'accept':3A 'access':8A,36B,83C,113C,131C,152C 'addit':104C 'allow':73C 'api':54B 'attack':43B,116C 'bypass':93C 'call':52B 'circumv':155C 'client':2A,22B,57B,65C,101C,143C 'consum':89C 'control':97C 'correct':68C 'credenti':58B,102C,144C 'cve':10A,13A 'direct':130C 'enabl':85C 'exchang':146C 'expos':48B,122C 'fail':66C 'flow':141C 'forgerock':1A,16B,21B,64C 'hold':44B 'ident':17B 'intend':95C 'leverag':126C 'new':112C 'oauth':18B 'obtain':110C,118C 'one':30B 'packag':19B 'possibl':136C 'present':33B 'proper':25B 'protect':40B,53B,90C,132C 'reach':39B 'refresh':4A,27B,49B,70C,75C,107C,123C,148C 'requir':62B,99C,142C 'resourc':41B,91C,133C 'secur':96C,140C 'standard':139C 'stolen':46B,120C 'token':5A,9A,28B,37B,50B,71C,76C,84C,108C,114C,124C,149C,153C 'treat':79C 'use':87C 'valid':7A,26B,69C,82C,100C 'vulner':128C 'without':55B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a ForgeRock client library in an application that calls protected resources with OAuth refresh tokens. Exposure depends on whether refresh tokens are stored or transmitted where an attacker could obtain them. The sources do not name affected versions or packages.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-7043","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7043","severity":null,"published_at":"2026-10-19T17:16:59+00:00","modified_at":"2026-10-19T21:06:28+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}