Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-6647— Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

Quick assessment

Affected
WSO2 WSO2 Identity Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在配置为不区分大小写用户存储（user store）但使用区分大小写数据库来存储身份数据的 WSO2 Identity Server 部署环境中，可能会出现用户名大小写处理不一致的问题。这种不一致会导致在特定生命周期事件中，OAuth 令牌撤销操作无法正确识别包含混合大小写字符的用户名，从而阻止令牌被正常撤销。 攻击者可以利用此漏洞，通过持有与混合大小写用户名关联的有效访问令牌或刷新令牌进行利用。在受影响的配置中，这些令牌可能无法在预期时间内被撤销。攻击者随后可在令牌过期前继续使用这些未被撤销的令牌，执行本应被限制

CVSS 7.4 · High

Possible ATT&CK Techniques 1 AI

T1551.004

Affected Version Matrix 3

VendorProduct Version RangeStatus
WSO2 WSO2 Carbon OAuth 7.0.385< 7.0.385.17 affected
7.5.23≤ * unaffected
WSO2 WSO2 Identity Server 7.2.0< 7.2.0.21 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-6647

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
Source: CVE Program / CVE List V5
Vulnerability Description
In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated. A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 Identity Server 7.2.0 ~ 7.2.0.21 -
WSO2 WSO2 Carbon OAuth 7.0.385 ~ 7.0.385.17 -

II. Public POCs for CVE-2026-6647

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-6647

请登录查看更多情报信息。

Other References for CVE-2026-6647 (1)

Same Patch Batch · WSO2 · 2026-10-28 · 5 CVEs total

CVE-2026-78674 8.8 HIGH Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrar
CVE-2025-14260 8.3 HIGH Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and Extern
CVE-2026-11854 6.1 MEDIUM Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
CVE-2026-3583 3.1 LOW Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupte

IV. Related Vulnerabilities

Same product: WSO2 Identity Server
Same vendor: WSO2
Same weakness: CWE-613