Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-3583low3.1

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Impact

WSO2 products, including API Manager, Traffic Manager, and Identity Server, have a vulnerability where the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This can cause a revoked access token to be re-issued to the client until the cache is cleared.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

What to do

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

WSO2 · WSO2

WSO2 API Manager

12 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

3.1.0 → before 3.1.0.367

custom versions

3.2.0 → before 3.2.0.475

custom versions

3.2.1 → before 3.2.1.106

custom versions

4.0.0 → before 4.0.0.394

custom versions

4.1.0 → before 4.1.0.267

custom versions

4.2.0 → before 4.2.0.207

custom versions

4.3.0 → before 4.3.0.120

custom versions

4.4.0 → before 4.4.0.83

custom versions

4.5.0 → before 4.5.0.67

custom versions

4.6.0 → before 4.6.0.29

custom versions

4.7.0 → before 4.7.0.3

custom versions

unaffected

unknown

0 → before 3.1.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Traffic Manager

4 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

4.5.0 → before 4.5.0.65

custom versions

4.6.0 → before 4.6.0.29

custom versions

4.7.0 → before 4.7.0.3

custom versions

unaffected

unknown

0 → before 4.5.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Universal Gateway

4 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

4.5.0 → before 4.5.0.67

custom versions

4.6.0 → before 4.6.0.29

custom versions

4.7.0 → before 4.7.0.3

custom versions

unaffected

unknown

0 → before 4.5.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 API Control Plane

4 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

4.5.0 → before 4.5.0.68

custom versions

4.6.0 → before 4.6.0.30

custom versions

4.7.0 → before 4.7.0.3

custom versions

unaffected

unknown

0 → before 4.5.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Identity Server

9 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.10.0 → before 5.10.0.397

custom versions

5.11.0 → before 5.11.0.444

custom versions

6.0.0 → before 6.0.0.270

custom versions

6.1.0 → before 6.1.0.269

custom versions

7.0.0 → before 7.0.0.152

custom versions

7.1.0 → before 7.1.0.61

custom versions

7.2.0 → before 7.2.0.20

custom versions

7.3.0 → before 7.3.0.1

custom versions

unaffected

unknown

0 → before 5.10.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Open Banking IAM

2 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

2.0.0 → before 2.0.0.434

custom versions

unaffected

unknown

0 → before 2.0.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Identity Server as Key Manager

2 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.10.0 → before 5.10.0.387

custom versions

unaffected

unknown

0 → before 5.10.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Open Banking AM

2 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

2.0.0 → before 2.0.0.414

custom versions

unaffected

unknown

0 → before 2.0.0

custom versions

Other versions: unaffected

WSO2 · WSO2

WSO2 Carbon OAuth

17 ranges
WSO2 version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

6.4.2 → before 6.4.2.178

custom versions

6.4.111 → before 6.4.111.174

custom versions

6.4.176 → before 6.4.176.38

custom versions

6.4.180 → before 6.4.180.25

custom versions

6.8.0 → before 6.8.0.59

custom versions

6.9.6 → before 6.9.6.36

custom versions

6.11.21 → before 6.11.21.118

custom versions

6.13.16 → before 6.13.16.32

custom versions

6.13.19 → before 6.13.19.23

custom versions

6.13.27 → before 6.13.27.21

custom versions

6.13.41 → before 6.13.41.9

custom versions

6.14.14 → before 6.14.14.3

custom versions

7.0.26 → before 7.0.26.103

custom versions

7.0.259 → before 7.0.259.54

custom versions

7.0.385 → before 7.0.385.15

custom versions

7.4.99 → before 7.4.99.5

custom versions

unaffected

7.5.78 → through *

custom versions

unknown

Other versions: unknown

Original source description

When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.

The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-3583

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-613 ↗

CWE-613: Insufficient Session Expiration

WSO2

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

WSO2 · platform conditions

Any condition may hold

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 3.1.0

Before: 3.1.0.367

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 3.2.0

Before: 3.2.0.475

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 3.2.1

Before: 3.2.1.106

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.0.0

Before: 4.0.0.394

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.1.0

Before: 4.1.0.267

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.2.0

Before: 4.2.0.207

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.3.0

Before: 4.3.0.120

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.4.0

Before: 4.4.0.83

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.5.0

Before: 4.5.0.67

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.6.0

Before: 4.6.0.29

Vulnerable product

cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.7.0

Before: 4.7.0.3

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.5.0

Before: 4.5.0.65

Vulnerable product

cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.6.0

Before: 4.6.0.29

Vulnerable product

cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*

From (inclusive): 4.7.0

Before: 4.7.0.3

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*

From (inclusive): 4.5.0

Before: 4.5.0.67

Vulnerable product

cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*

From (inclusive): 4.6.0

Before: 4.6.0.29

Vulnerable product

cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*

From (inclusive): 4.7.0

Before: 4.7.0.3

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*

From (inclusive): 4.5.0

Before: 4.5.0.68

Vulnerable product

cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*

From (inclusive): 4.6.0

Before: 4.6.0.30

Vulnerable product

cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*

From (inclusive): 4.7.0

Before: 4.7.0.3

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 5.10.0

Before: 5.10.0.397

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 5.11.0

Before: 5.11.0.444

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 6.0.0

Before: 6.0.0.270

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 6.1.0

Before: 6.1.0.269

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 7.0.0

Before: 7.0.0.152

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 7.1.0

Before: 7.1.0.61

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 7.2.0

Before: 7.2.0.20

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

From (inclusive): 7.3.0

Before: 7.3.0.1

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*

From (inclusive): 2.0.0

Before: 2.0.0.434

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*

From (inclusive): 5.10.0

Before: 5.10.0.387

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*

From (inclusive): 2.0.0

Before: 2.0.0.414

Any condition may hold

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.4.2

Before: 6.4.2.178

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.4.111

Before: 6.4.111.174

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.4.176

Before: 6.4.176.38

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.4.180

Before: 6.4.180.25

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.8.0

Before: 6.8.0.59

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.9.6

Before: 6.9.6.36

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.11.21

Before: 6.11.21.118

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.13.16

Before: 6.13.16.32

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.13.19

Before: 6.13.19.23

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.13.27

Before: 6.13.27.21

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.13.41

Before: 6.13.41.9

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 6.14.14

Before: 6.14.14.3

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 7.0.26

Before: 7.0.26.103

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 7.0.259

Before: 7.0.259.54

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 7.0.385

Before: 7.0.385.15

Vulnerable product

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 7.4.99

Before: 7.4.99.5

Required environment

cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*

From (inclusive): 7.5.78

Through (inclusive): *

Original applicability statements
[
  {
    "operator": "OR",
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.1.0",
            "versionEndExcluding": "3.1.0.367"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.2.0",
            "versionEndExcluding": "3.2.0.475"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "3.2.1",
            "versionEndExcluding": "3.2.1.106"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.0.0",
            "versionEndExcluding": "4.0.0.394"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.1.0",
            "versionEndExcluding": "4.1.0.267"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.2.0",
            "versionEndExcluding": "4.2.0.207"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.3.0",
            "versionEndExcluding": "4.3.0.120"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.4.0",
            "versionEndExcluding": "4.4.0.83"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.5.0",
            "versionEndExcluding": "4.5.0.67"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.6.0",
            "versionEndExcluding": "4.6.0.29"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.7.0",
            "versionEndExcluding": "4.7.0.3"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.5.0",
            "versionEndExcluding": "4.5.0.65"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.6.0",
            "versionEndExcluding": "4.6.0.29"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.7.0",
            "versionEndExcluding": "4.7.0.3"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.5.0",
            "versionEndExcluding": "4.5.0.67"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.6.0",
            "versionEndExcluding": "4.6.0.29"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.7.0",
            "versionEndExcluding": "4.7.0.3"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.5.0",
            "versionEndExcluding": "4.5.0.68"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.6.0",
            "versionEndExcluding": "4.6.0.30"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.7.0",
            "versionEndExcluding": "4.7.0.3"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.10.0",
            "versionEndExcluding": "5.10.0.397"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.11.0",
            "versionEndExcluding": "5.11.0.444"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.0.0",
            "versionEndExcluding": "6.0.0.270"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.1.0",
            "versionEndExcluding": "6.1.0.269"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.0.0",
            "versionEndExcluding": "7.0.0.152"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.1.0",
            "versionEndExcluding": "7.1.0.61"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.2.0",
            "versionEndExcluding": "7.2.0.20"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.3.0",
            "versionEndExcluding": "7.3.0.1"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.0.0",
            "versionEndExcluding": "2.0.0.434"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.10.0",
            "versionEndExcluding": "5.10.0.387"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.0.0",
            "versionEndExcluding": "2.0.0.414"
          }
        ]
      },
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.4.2",
            "versionEndExcluding": "6.4.2.178"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.4.111",
            "versionEndExcluding": "6.4.111.174"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.4.176",
            "versionEndExcluding": "6.4.176.38"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.4.180",
            "versionEndExcluding": "6.4.180.25"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.8.0",
            "versionEndExcluding": "6.8.0.59"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.9.6",
            "versionEndExcluding": "6.9.6.36"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.11.21",
            "versionEndExcluding": "6.11.21.118"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.13.16",
            "versionEndExcluding": "6.13.16.32"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.13.19",
            "versionEndExcluding": "6.13.19.23"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.13.27",
            "versionEndExcluding": "6.13.27.21"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.13.41",
            "versionEndExcluding": "6.13.41.9"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.14.14",
            "versionEndExcluding": "6.14.14.3"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.0.26",
            "versionEndExcluding": "7.0.26.103"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.0.259",
            "versionEndExcluding": "7.0.259.54"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.0.385",
            "versionEndExcluding": "7.0.385.15"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.4.99",
            "versionEndExcluding": "7.4.99.5"
          },
          {
            "vulnerable": false,
            "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "7.5.78",
            "versionEndIncluding": "*"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 2
WSO2

Assigning organization

2026-10-28
CISA-ADP

Additional data publisher

2026-10-29

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/
vendor-advisoryWSO2