Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.367affected
  • 3.2.0 to < 3.2.0.475affected
  • 3.2.1 to < 3.2.1.106affected
  • 4.0.0 to < 4.0.0.394affected
  • 4.1.0 to < 4.1.0.267affected
  • 4.2.0 to < 4.2.0.207affected
  • 4.3.0 to < 4.3.0.120affected
  • 4.4.0 to < 4.4.0.83affected
  • 4.5.0 to < 4.5.0.67affected
  • 4.6.0 to < 4.6.0.29affected
  • 4.7.0 to < 4.7.0.3affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.65affected
  • 4.6.0 to < 4.6.0.29affected
  • 4.7.0 to < 4.7.0.3affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.67affected
  • 4.6.0 to < 4.6.0.29affected
  • 4.7.0 to < 4.7.0.3affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.68affected
  • 4.6.0 to < 4.6.0.30affected
  • 4.7.0 to < 4.7.0.3affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.397affected
  • 5.11.0 to < 5.11.0.444affected
  • 6.0.0 to < 6.0.0.270affected
  • 6.1.0 to < 6.1.0.269affected
  • 7.0.0 to < 7.0.0.152affected
  • 7.1.0 to < 7.1.0.61affected
  • 7.2.0 to < 7.2.0.20affected
  • 7.3.0 to < 7.3.0.1affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.434affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.387affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.414affected

WSO2 WSO2 Carbon OAuth

Default version status: unknown

  • 6.4.2 to < 6.4.2.178affected
  • 6.4.111 to < 6.4.111.174affected
  • 6.4.176 to < 6.4.176.38affected
  • 6.4.180 to < 6.4.180.25affected
  • 6.8.0 to < 6.8.0.59affected
  • 6.9.6 to < 6.9.6.36affected
  • 6.11.21 to < 6.11.21.118affected
  • 6.13.16 to < 6.13.16.32affected
  • 6.13.19 to < 6.13.19.23affected
  • 6.13.27 to < 6.13.27.21affected
  • 6.13.41 to < 6.13.41.9affected
  • 6.14.14 to < 6.14.14.3affected
  • 7.0.26 to < 7.0.26.103affected
  • 7.0.259 to < 7.0.259.54affected
  • 7.0.385 to < 7.0.385.15affected
  • 7.4.99 to < 7.4.99.5affected
  • 7.5.78 to ≤ *unaffected

References