CVE-2026-3583
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
At a glance
- Severity
- LOW 3.1
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
Description
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L | WSO2 |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2026-112400
- GCVE · GCVE-0-2026-3583
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 API Manager | unknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.367 ; affected 3.2.0 < 3.2.0.475 ; affected 3.2.1 < 3.2.1.106 ; affected 4.0.0 < 4.0.0.394 ; affected 4.1.0 < 4.1.0.267 |
| WSO2 · WSO2 Traffic Manager | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.65 ; affected 4.6.0 < 4.6.0.29 ; affected 4.7.0 < 4.7.0.3 |
| WSO2 · WSO2 Universal Gateway | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.67 ; affected 4.6.0 < 4.6.0.29 ; affected 4.7.0 < 4.7.0.3 |
| WSO2 · WSO2 API Control Plane | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.68 ; affected 4.6.0 < 4.6.0.30 ; affected 4.7.0 < 4.7.0.3 |
| WSO2 · WSO2 Identity Server | unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.397 ; affected 5.11.0 < 5.11.0.444 ; affected 6.0.0 < 6.0.0.270 ; affected 6.1.0 < 6.1.0.269 ; affected 7.0.0 < 7.0.0.152 |
| WSO2 · WSO2 Open Banking IAM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.434 |
| WSO2 · WSO2 Identity Server as Key Manager | unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.387 |
| WSO2 · WSO2 Open Banking AM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.414 |
| WSO2 · WSO2 Carbon OAuth | affected 6.4.2 < 6.4.2.178 ; affected 6.4.111 < 6.4.111.174 ; affected 6.4.176 < 6.4.176.38 ; affected 6.4.180 < 6.4.180.25 ; affected 6.8.0 < 6.8.0.59 ; affected 6.9.6 < 6.9.6.36 |
References
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |