CVE-2025-12624

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Los tokens de acceso activos no son revocados o invalidados cuando una cuenta de usuario es bloqueada dentro de WSO2 Identity Server. Esta falla en aplicar la revocación permite que los tokens válidos, emitidos previamente, permanezcan utilizables, posibilitando el acceso continuo a recursos protegidos por cuentas de usuario bloqueadas. La consecuencia de seguridad es que una cuenta de usuario bloqueada puede mantener el acceso a recursos protegidos mediante el uso de tokens de acceso existentes y no caducados. Esto crea una brecha de seguridad donde las políticas de control de acceso son eludidas, lo que podría llevar a un acceso no autorizado a datos o acciones hasta que los tokens caduquen de forma natural.

Information

Published : 2026-04-16 11:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-12624

Mitre link : CVE-2025-12624

CVE.ORG link : CVE-2025-12624

JSON object : View

Products Affected

wso2

identity_server

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-12624", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12624", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T12:19:51.834842Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.2.0", "versionType": "custom"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.0.35", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-16T11:16:26.447", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire."}, {"lang": "es", "value": "Los tokens de acceso activos no son revocados o invalidados cuando una cuenta de usuario es bloqueada dentro de WSO2 Identity Server. Esta falla en aplicar la revocaci\u00f3n permite que los tokens v\u00e1lidos, emitidos previamente, permanezcan utilizables, posibilitando el acceso continuo a recursos protegidos por cuentas de usuario bloqueadas.\n\nLa consecuencia de seguridad es que una cuenta de usuario bloqueada puede mantener el acceso a recursos protegidos mediante el uso de tokens de acceso existentes y no caducados. Esto crea una brecha de seguridad donde las pol\u00edticas de control de acceso son eludidas, lo que podr\u00eda llevar a un acceso no autorizado a datos o acciones hasta que los tokens caduquen de forma natural."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2689AF3E-01AA-4B79-BA55-6BB3D81E16CF"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}