Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-0326— Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

Quick assessment

Affected
WSO2 WSO2 Identity Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

系统在敏感账户管理操作（如密码重置、角色变更或子组织禁用）期间，未能使与子组织用户关联的现有访问令牌失效。这一疏漏导致先前颁发的令牌在用户的访问上下文已通过管理操作被修改或撤销后，仍然保持有效。 该问题可能导致恶意攻击者进行未授权访问，但仅在所有以下条件同时满足时才会发生：先前颁发的访问令牌仍处于活动状态，且这些令牌已泄露给恶意攻击者。

AI Predicted 6.5 Difficulty: Moderate

Affected Version Matrix 4

VendorProduct Version RangeStatus
WSO2 WSO2 Carbon OAuth 7.0.26< 7.0.26.51 affected
x≤ * unaffected
WSO2 WSO2 Identity Server < 7.0.0 unknown
7.0.0< 7.0.0.85 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-0326

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
Source: CVE Program / CVE List V5
Vulnerability Description
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 Identity Server 7.0.0 ~ 7.0.0.85 -
WSO2 WSO2 Carbon OAuth 7.0.26 ~ 7.0.26.51 -

II. Public POCs for CVE-2025-0326

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-0326

请登录查看更多情报信息。

Vendor Pages for CVE-2025-0326 (1)

Same Patch Batch · WSO2 · 2026-10-21 · 6 CVEs total

CVE-2024-5139 6.1 MEDIUM Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Mani
CVE-2024-7478 5.8 MEDIUM Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Accoun
CVE-2024-4989 5.4 MEDIUM Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
CVE-2024-5563 4.8 MEDIUM Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows
CVE-2024-6423 4.0 MEDIUM Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential I

IV. Related Vulnerabilities

Same product: WSO2 Identity Server
Same vendor: WSO2
Same weakness: CWE-613

V. Comments for CVE-2025-0326

No comments yet

Leave a comment