Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-3583EUVD-2026-112400GHSA-R767-66JG-55Q2

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.1.0.367, 3.2.0.475, 3.2.1.106, 4.0.0.394, 4.1.0.267, and 36 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

The affected software is multiple WSO2 products that use OAuth2 token introspection with the allowed_scopes setting enabled. In these products, a revoked access token can be returned to clients from cache until the cache entry expires, which can prevent users from obtaining new valid tokens and disrupt their authentication.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • WSO2 WSO2 API Manager

    From 3.1.0 · fixed in 3.1.0.367; From 3.2.0 · fixed in 3.2.0.475; From 3.2.1 · fixed in 3.2.1.106; From 4.0.0 · fixed in 4.0.0.394; From 4.1.0 · fixed in 4.1.0.267; From 4.2.0 · fixed in 4.2.0.207; From 4.3.0 · fixed in 4.3.0.120; From 4.4.0 · fixed in 4.4.0.83; From 4.5.0 · fixed in 4.5.0.67; From 4.6.0 · fixed in 4.6.0.29; From 4.7.0 · fixed in 4.7.0.3

  • WSO2 WSO2 Traffic Manager

    From 4.5.0 · fixed in 4.5.0.65; From 4.6.0 · fixed in 4.6.0.29; From 4.7.0 · fixed in 4.7.0.3

  • WSO2 WSO2 Universal Gateway

    From 4.5.0 · fixed in 4.5.0.67; From 4.6.0 · fixed in 4.6.0.29; From 4.7.0 · fixed in 4.7.0.3

  • WSO2 WSO2 API Control Plane

    From 4.5.0 · fixed in 4.5.0.68; From 4.6.0 · fixed in 4.6.0.30; From 4.7.0 · fixed in 4.7.0.3

  • WSO2 WSO2 Identity Server

    From 5.10.0 · fixed in 5.10.0.397; From 5.11.0 · fixed in 5.11.0.444; From 6.0.0 · fixed in 6.0.0.270; From 6.1.0 · fixed in 6.1.0.269; From 7.0.0 · fixed in 7.0.0.152; From 7.1.0 · fixed in 7.1.0.61; From 7.2.0 · fixed in 7.2.0.20; From 7.3.0 · fixed in 7.3.0.1

  • WSO2 WSO2 Open Banking IAM

    From 2.0.0 · fixed in 2.0.0.434

  • WSO2 WSO2 Identity Server as Key Manager

    From 5.10.0 · fixed in 5.10.0.387

  • WSO2 WSO2 Open Banking AM

    From 2.0.0 · fixed in 2.0.0.414

  • org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth

    From 6.4.2 · fixed in 6.4.2.178; From 6.4.111 · fixed in 6.4.111.174; From 6.4.176 · fixed in 6.4.176.38; From 6.4.180 · fixed in 6.4.180.25; From 6.8.0 · fixed in 6.8.0.59; From 6.9.6 · fixed in 6.9.6.36; From 6.11.21 · fixed in 6.11.21.118; From 6.13.16 · fixed in 6.13.16.32; From 6.13.19 · fixed in 6.13.19.23; From 6.13.27 · fixed in 6.13.27.21; From 6.13.41 · fixed in 6.13.41.9; From 6.14.14 · fixed in 6.14.14.3; From 7.0.26 · fixed in 7.0.26.103; From 7.0.259 · fixed in 7.0.259.54; From 7.0.385 · fixed in 7.0.385.15; From 7.4.99 · fixed in 7.4.99.5

References 1

security.docs.wso2.com