---
id: "CVE-2025-7043"
kind: "vulnerability"
aliases: ["CVE-2025-7043"]
title: "ForgeRock client accepts refresh tokens as valid access tokens"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["forgerock", "identity", "oauth", "package"]
not_affected_if: ["unknown"]
published_at: "2026-10-19T17:16:59+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:16:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7043", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# ForgeRock client accepts refresh tokens as valid access tokens

The ForgeRock client does not properly validate refresh tokens, so one can be presented as an access token to reach protected resources. An attacker holding a stolen or exposed refresh token can call protected APIs without the client credentials that should be required.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-7043

## From the sources

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.

An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_