CVE-2025-1397Medium 4.8Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers0.2%
CVE-2024-9517Medium 4.9Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts0.2%
CVE-2026-6647High 7.4Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events0.2%
CVE-2026-3583Low 3.1Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]0.3%
CVE-2025-0326High 7.4Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access0.3%
CVE-2025-13173Medium 6.5Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination0.2%
CVE-2025-12627Low 2.4Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions0.2%
CVE-2024-8995Medium 4.9Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access0.2%