Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Summary
| CVE | CVE-2026-3583 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-28 20:17:24 UTC |
| Updated | 2026-10-29 04:18:36 UTC |
| Description | When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows. |
Risk And Classification
Primary CVSS: v3.1 3.1 LOW from ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Problem Types: CWE-613 | CWE-613 CWE-613: Insufficient Session Expiration
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 3.1 | LOW | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 3.1 | LOW | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 API Manager | unknown 3.1.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.1.0 3.1.0.367 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.475 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.106 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.394 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.267 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.207 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.120 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.4.0 4.4.0.83 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.5.0 4.5.0.67 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.6.0 4.6.0.29 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.7.0 4.7.0.3 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | unknown 4.5.0 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | affected 4.5.0 4.5.0.65 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | affected 4.6.0 4.6.0.29 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | affected 4.7.0 4.7.0.3 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | unknown 4.5.0 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | affected 4.5.0 4.5.0.67 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | affected 4.6.0 4.6.0.29 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | affected 4.7.0 4.7.0.3 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | unknown 4.5.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | affected 4.5.0 4.5.0.68 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | affected 4.6.0 4.6.0.30 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | affected 4.7.0 4.7.0.3 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.10.0 5.10.0.397 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.11.0 5.11.0.444 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.0.0 6.0.0.270 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.1.0 6.1.0.269 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.0.0 7.0.0.152 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.1.0 7.1.0.61 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.2.0 7.2.0.20 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.3.0 7.3.0.1 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.434 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.387 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 2.0.0 2.0.0.414 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.4.2 6.4.2.178 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.4.111 6.4.111.174 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.4.176 6.4.176.38 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.4.180 6.4.180.25 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.8.0 6.8.0.59 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.9.6 6.9.6.36 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.11.21 6.11.21.118 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.13.16 6.13.16.32 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.13.19 6.13.19.23 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.13.27 6.13.27.21 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.13.41 6.13.41.9 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 6.14.14 6.14.14.3 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 7.0.26 7.0.26.103 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 7.0.259 7.0.259.54 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 7.0.385 7.0.385.15 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | affected 7.4.99 7.4.99.5 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon OAuth | unaffected 7.5.78 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution
There are currently no legacy QID mappings associated with this CVE.