Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-13173— Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Quick assessment

Affected
WSO2 WSO2 API Control Plane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当用户会话终止时，与之关联的令牌未被撤销，除非随后发起了另一个单点登录（SSO）请求。此问题出现在启用了“会话绑定令牌”功能并开启了令牌绑定验证，但未激活“用户登出时撤销令牌”选项的情况下。软件未能自动在用户会话结束时使会话绑定令牌失效。 该漏洞在启用令牌绑定验证时存在。因此，攻击者若持有有效的会话绑定令牌，可利用此缺陷在用户会话结束后继续未经授权地访问应用程序和资源，可能导致敏感用户数据泄露。

CVSS 6.5 · Medium

Affected Version Matrix 48

VendorProduct Version RangeStatus
WSO2 WSO2 API Control Plane < 4.5.0 unknown
4.5.0< 4.5.0.47 affected
4.6.0< 4.6.0.13 affected
WSO2 WSO2 API Manager < 3.1.0 unknown
3.1.0< 3.1.0.352 affected
3.2.0< 3.2.0.456 affected
3.2.1< 3.2.1.81 affected
4.0.0< 4.0.0.376 affected
4.1.0< 4.1.0.246 affected
4.2.0< 4.2.0.186 affected
4.3.0< 4.3.0.97 affected
… +3 more rows
WSO2 WSO2 Carbon OAuth 6.4.2< 6.4.2.171 affected
6.4.111< 6.4.111.165 affected
6.4.176< 6.4.176.30 affected
6.4.180< 6.4.180.14 affected
6.8.0< 6.8.0.54 affected
6.9.6< 6.9.6.29 affected
6.11.21< 6.11.21.94 affected
6.13.16< 6.13.16.21 affected
… +6 more rows
WSO2 WSO2 Identity Server < 5.10.0 unknown
5.10.0< 5.10.0.381 affected
5.11.0< 5.11.0.428 affected
6.0.0< 6.0.0.255 affected
6.1.0< 6.1.0.256 affected
7.0.0< 7.0.0.133 affected
7.1.0< 7.1.0.41 affected
7.2.0< 7.2.0.3 affected
WSO2 WSO2 Identity Server as Key Manager < 5.10.0 unknown
5.10.0< 5.10.0.372 affected
WSO2 WSO2 Open Banking AM < 2.0.0 unknown
2.0.0< 2.0.0.401 affected
WSO2 WSO2 Open Banking IAM < 2.0.0 unknown
2.0.0< 2.0.0.421 affected
WSO2 WSO2 Traffic Manager < 4.5.0 unknown
4.5.0< 4.5.0.45 affected
4.6.0< 4.6.0.11 affected
WSO2 WSO2 Universal Gateway < 4.5.0 unknown
4.5.0< 4.5.0.46 affected
4.6.0< 4.6.0.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-13173

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Source: CVE Program / CVE List V5
Vulnerability Description
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Control Plane 4.5.0 ~ 4.5.0.47 -
WSO2 WSO2 Universal Gateway 4.5.0 ~ 4.5.0.46 -
WSO2 WSO2 API Manager 3.1.0 ~ 3.1.0.352 -
WSO2 WSO2 Traffic Manager 4.5.0 ~ 4.5.0.45 -
WSO2 WSO2 Identity Server as Key Manager 5.10.0 ~ 5.10.0.372 -
WSO2 WSO2 Open Banking IAM 2.0.0 ~ 2.0.0.421 -
WSO2 WSO2 Open Banking AM 2.0.0 ~ 2.0.0.401 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.381 -
WSO2 WSO2 Carbon OAuth 6.4.2 ~ 6.4.2.171 -

II. Public POCs for CVE-2025-13173

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-13173

请登录查看更多情报信息。

Other References for CVE-2025-13173 (1)

Same Patch Batch · WSO2 · 2026-10-19 · 7 CVEs total

CVE-2025-10149 8.2 HIGH Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Tak
CVE-2025-7043 5.4 MEDIUM Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Re
CVE-2025-13591 5.3 MEDIUM Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Accou
CVE-2025-7203 4.9 MEDIUM Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2
CVE-2025-6623 4.3 MEDIUM Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation
CVE-2024-4412 2.7 LOW Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary O

IV. Related Vulnerabilities

Same product: WSO2 API Control Plane
Same vendor: WSO2
Same weakness: CWE-613

V. Comments for CVE-2025-13173

No comments yet

Leave a comment