{"api_version":"1","generated_at":"2026-10-19T21:56:33+00:00","cve":"CVE-2025-13173","urls":{"html":"https://cve.report/CVE-2025-13173","api":"https://cve.report/api/cve/CVE-2025-13173.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-13173","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-13173"},"summary":{"title":"Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination","description":"Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the \"Revoke token upon user logout\" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.\n\nThis vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-10-19 17:16:59","updated_at":"2026-10-19 21:06:28"},"problem_types":["CWE-613","CWE-613 CWE-613: Insufficient Session Expiration"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13173","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13173","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"unknown 4.5.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"affected 4.5.0 4.5.0.47 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"affected 4.6.0 4.6.0.13 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"unknown 4.5.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"affected 4.5.0 4.5.0.46 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"affected 4.6.0 4.6.0.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 3.1.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.1.0 3.1.0.352 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.456 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.1 3.2.1.81 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.376 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.246 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.186 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.97 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.4.0 4.4.0.61 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.5.0 4.5.0.46 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.6.0 4.6.0.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"unknown 4.5.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"affected 4.5.0 4.5.0.45 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"affected 4.6.0 4.6.0.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.10.0 5.10.0.372 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"affected 2.0.0 2.0.0.421 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 2.0.0 2.0.0.401 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.10.0 5.10.0.381 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.11.0 5.11.0.428 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.0.0 6.0.0.255 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.256 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.0.0 7.0.0.133 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.1.0 7.1.0.41 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.2.0 7.2.0.3 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.4.2 6.4.2.171 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.4.111 6.4.111.165 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.4.176 6.4.176.30 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.4.180 6.4.180.14 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.8.0 6.8.0.54 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.9.6 6.9.6.29 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.11.21 6.11.21.94 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.13.16 6.13.16.21 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.13.19 6.13.19.14 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.13.27 6.13.27.10 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 6.13.41 6.13.41.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 7.0.26 7.0.26.87 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 7.0.259 7.0.259.34 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon OAuth","version":"affected 7.0.385 7.0.385.3 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.47","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.13","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.46","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.11","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.352","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.456","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.81","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.376","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.246","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.186","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.97","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.61","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.46","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.11","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.45","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.11","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.372","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.421","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.401","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.381","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.428","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.255","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.256","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.133","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.41","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.0.3","status":"affected","version":"7.2.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth","product":"WSO2 Carbon OAuth","vendor":"WSO2","versions":[{"lessThan":"6.4.2.171","status":"affected","version":"6.4.2","versionType":"custom"},{"lessThan":"6.4.111.165","status":"affected","version":"6.4.111","versionType":"custom"},{"lessThan":"6.4.176.30","status":"affected","version":"6.4.176","versionType":"custom"},{"lessThan":"6.4.180.14","status":"affected","version":"6.4.180","versionType":"custom"},{"lessThan":"6.8.0.54","status":"affected","version":"6.8.0","versionType":"custom"},{"lessThan":"6.9.6.29","status":"affected","version":"6.9.6","versionType":"custom"},{"lessThan":"6.11.21.94","status":"affected","version":"6.11.21","versionType":"custom"},{"lessThan":"6.13.16.21","status":"affected","version":"6.13.16","versionType":"custom"},{"lessThan":"6.13.19.14","status":"affected","version":"6.13.19","versionType":"custom"},{"lessThan":"6.13.27.10","status":"affected","version":"6.13.27","versionType":"custom"},{"lessThan":"6.13.41.1","status":"affected","version":"6.13.41","versionType":"custom"},{"lessThan":"7.0.26.87","status":"affected","version":"7.0.26","versionType":"custom"},{"lessThan":"7.0.259.34","status":"affected","version":"7.0.259","versionType":"custom"},{"lessThan":"7.0.385.3","status":"affected","version":"7.0.385","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.47","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.0.13","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.46","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.0.11","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1.0.352","versionStartIncluding":"3.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0.456","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.1.81","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.376","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.246","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.186","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.97","versionStartIncluding":"4.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.4.0.61","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.46","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.0.11","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.45","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.0.11","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.372","versionStartIncluding":"5.10.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.421","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.401","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.381","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.0.428","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0.255","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.0.256","versionStartIncluding":"6.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.0.133","versionStartIncluding":"7.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.0.41","versionStartIncluding":"7.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.0.3","versionStartIncluding":"7.2.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.2.171","versionStartIncluding":"6.4.2","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.111.165","versionStartIncluding":"6.4.111","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.176.30","versionStartIncluding":"6.4.176","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.180.14","versionStartIncluding":"6.4.180","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.8.0.54","versionStartIncluding":"6.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.6.29","versionStartIncluding":"6.9.6","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.11.21.94","versionStartIncluding":"6.11.21","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.16.21","versionStartIncluding":"6.13.16","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.19.14","versionStartIncluding":"6.13.19","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.27.10","versionStartIncluding":"6.13.27","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.41.1","versionStartIncluding":"6.13.41","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.26.87","versionStartIncluding":"7.0.26","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.259.34","versionStartIncluding":"7.0.259","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.385.3","versionStartIncluding":"7.0.385","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the \"Revoke token upon user logout\" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.\n\nThis vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data."}],"value":"Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the \"Revoke token upon user logout\" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.\n\nThis vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data."}],"impacts":[{"capecId":"CAPEC-276","descriptions":[{"lang":"en","value":"CAPEC-276 CAPEC-276: Session Token Interception"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613: Insufficient Session Expiration","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T16:49:08.687Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution</span></a> <br>"}],"value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution"}],"source":{"advisory":"WSO2-2025-4727","discovery":"INTERNAL"},"title":"Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2025-13173","datePublished":"2026-10-19T16:49:08.687Z","dateReserved":"2025-11-14T10:17:18.989Z","dateUpdated":"2026-10-19T16:49:08.687Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 17:16:59","lastModifiedDate":"2026-10-19 21:06:28","problem_types":["CWE-613","CWE-613 CWE-613: Insufficient Session Expiration"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.7}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"13173","Ordinal":"1","Title":"Improper Token Revocation via Session-Bound Token Flow in Multip","CVE":"CVE-2025-13173","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"13173","Ordinal":"1","NoteData":"Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the \"Revoke token upon user logout\" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.\n\nThis vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.","Type":"Description","Title":"Improper Token Revocation via Session-Bound Token Flow in Multip"}]}}}