Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
CVE-2025-0326
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-0326
WSO2 Identity Server
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WSO2 Carbon OAuth
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "7.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.0.0.85",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon OAuth",
"versions": [
{
"status": "affected",
"version": "7.0.26",
"lessThan": "7.0.26.51",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x",
"versionType": "custom",
"lessThanOrEqual": "*"
}
],
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2025-0326
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #49035 · Revision 1
- Added to Heist Feed
- Publisher date