CVE-2025-0326

Awaiting Analysis Awaiting Analysis - Queue

Persistent Access Token Exposure in Sub-Organization User Management

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: WSO2 LLC

Description

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2025-0326

EUVD

EUVD-2025-211143

Affected Vendors & Products

Vendor	Product	Version / Range
WSO2	WSO2 Identity Server	7.0.0
WSO2	WSO2 Carbon OAuth	7.0.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability involves the system not properly invalidating access tokens when a user's account is modified or disabled. For example, if a user's password is reset or their role is changed, old tokens may still work even though they should no longer be valid. This creates a security risk where unauthorized access could occur if those tokens were previously exposed.

Impact Analysis

If you are an administrator or user of a system using WSO2 Identity Server or WSO2 Carbon OAuth, this vulnerability could allow attackers to gain unauthorized access to your account or data. This is only possible if old tokens were already compromised and remain active after administrative changes.

Compliance Impact

This vulnerability could lead to unauthorized access if exposed tokens remain active after administrative changes, potentially violating compliance requirements for data protection and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Invalidate all existing access tokens for sub-organization users during password resets, role changes, or sub-organization disablement. Review and revoke any exposed tokens to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2025-0326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...