Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-3583— Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当启用 配置时，OAuth2 令牌内省机制在收到撤销请求后，不会立即使缓存中的令牌失效。这会导致一种情况：在撤销请求发出前刚刚经过内省检查的访问令牌，在撤销后仍可能被再次返回给客户端，直至相关的缓存条目被清除。 其安全后果是：已被撤销的访问令牌可能在缓存有效期内被重新颁发给客户端。虽然该重新颁发的令牌不会被用于 API 授权（即不被视为有效），但受影响的用户在缓存被清除之前可能无法获取新的有效访问令牌，从而导致认证流程中断。

CVSS 3.1 · Low

Affected Version Matrix 56

VendorProduct Version RangeStatus
WSO2 WSO2 API Control Plane < 4.5.0 unknown
4.5.0< 4.5.0.68 affected
4.6.0< 4.6.0.30 affected
4.7.0< 4.7.0.3 affected
WSO2 WSO2 API Manager < 3.1.0 unknown
3.1.0< 3.1.0.367 affected
3.2.0< 3.2.0.475 affected
3.2.1< 3.2.1.106 affected
4.0.0< 4.0.0.394 affected
4.1.0< 4.1.0.267 affected
4.2.0< 4.2.0.207 affected
4.3.0< 4.3.0.120 affected
… +4 more rows
WSO2 WSO2 Carbon OAuth 6.4.2< 6.4.2.178 affected
6.4.111< 6.4.111.174 affected
6.4.176< 6.4.176.38 affected
6.4.180< 6.4.180.25 affected
6.8.0< 6.8.0.59 affected
6.9.6< 6.9.6.36 affected
6.11.21< 6.11.21.118 affected
6.13.16< 6.13.16.32 affected
… +9 more rows
WSO2 WSO2 Identity Server < 5.10.0 unknown
5.10.0< 5.10.0.397 affected
5.11.0< 5.11.0.444 affected
6.0.0< 6.0.0.270 affected
6.1.0< 6.1.0.269 affected
7.0.0< 7.0.0.152 affected
7.1.0< 7.1.0.61 affected
7.2.0< 7.2.0.20 affected
… +1 more rows
WSO2 WSO2 Identity Server as Key Manager < 5.10.0 unknown
5.10.0< 5.10.0.387 affected
WSO2 WSO2 Open Banking AM < 2.0.0 unknown
2.0.0< 2.0.0.414 affected
WSO2 WSO2 Open Banking IAM < 2.0.0 unknown
2.0.0< 2.0.0.434 affected
WSO2 WSO2 Traffic Manager < 4.5.0 unknown
4.5.0< 4.5.0.65 affected
4.6.0< 4.6.0.29 affected
4.7.0< 4.7.0.3 affected
WSO2 WSO2 Universal Gateway < 4.5.0 unknown
4.5.0< 4.5.0.67 affected
4.6.0< 4.6.0.29 affected
4.7.0< 4.7.0.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-3583

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Source: CVE Program / CVE List V5
Vulnerability Description
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 3.1.0 ~ 3.1.0.367 -
WSO2 WSO2 Traffic Manager 4.5.0 ~ 4.5.0.65 -
WSO2 WSO2 Universal Gateway 4.5.0 ~ 4.5.0.67 -
WSO2 WSO2 API Control Plane 4.5.0 ~ 4.5.0.68 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.397 -
WSO2 WSO2 Open Banking IAM 2.0.0 ~ 2.0.0.434 -
WSO2 WSO2 Identity Server as Key Manager 5.10.0 ~ 5.10.0.387 -
WSO2 WSO2 Open Banking AM 2.0.0 ~ 2.0.0.414 -
WSO2 WSO2 Carbon OAuth 6.4.2 ~ 6.4.2.178 -

II. Public POCs for CVE-2026-3583

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-3583

请登录查看更多情报信息。

Other References for CVE-2026-3583 (1)

Same Patch Batch · WSO2 · 2026-10-28 · 5 CVEs total

CVE-2026-78674 8.8 HIGH Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrar
CVE-2025-14260 8.3 HIGH Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and Extern
CVE-2026-6647 7.4 HIGH Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continu
CVE-2026-11854 6.1 MEDIUM Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2
Same weakness: CWE-613