CVE-2025-12624
Access Token Revocation Failure in WSO2 Identity Server
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | identity_server | 5.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in WSO2 Identity Server where active access tokens are not revoked or invalidated when a user account is locked.
Because the tokens remain valid even after the account is locked, the locked user can still use these tokens to access protected resources.
This means that the system fails to enforce proper access control by allowing continued access through previously issued tokens.
How can this vulnerability impact me? :
The impact of this vulnerability is that a locked user account can still access protected resources using existing, unexpired access tokens.
This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or unauthorized actions.
The risk persists until the tokens naturally expire, which could allow attackers or unauthorized users to maintain access longer than intended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows locked user accounts to continue accessing protected resources using valid, unexpired access tokens. This bypass of access control policies can lead to unauthorized data access or actions.
Such unauthorized access could potentially violate compliance requirements in standards and regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data.
Failure to revoke access tokens upon account lockout undermines the enforcement of security policies, increasing the risk of data breaches and non-compliance with regulatory obligations related to data confidentiality and integrity.