Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
Impact
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions.
Source excerpt · WSO2What to do
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-3857/#solution
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
WSO2 · WSO2
WSO2 Identity Server
2 ranges
WSO2 · WSO2
WSO2 Identity Server
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7.0.0 → before 7.0.0.85
custom versions
unknown
0 → before 7.0.0
custom versions
Other versions: unaffected
WSO2 · WSO2
WSO2 Carbon OAuth
2 ranges
WSO2 · WSO2
WSO2 Carbon OAuth
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7.0.26 → before 7.0.26.51
custom versions
unaffected
x → through *
custom versions
Other versions: unknown
Original source description
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions.
The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2025-0326View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.