CVE-2025-12627

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::

History

No history.

Information

Published : 2026-08-06 08:16

Updated : 2026-08-10 14:17

NVD link : CVE-2025-12627

Mitre link : CVE-2025-12627

CVE.ORG link : CVE-2025-12627

JSON object : View

Products Affected

wso2

identity_server

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-12627", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12627", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:33:32.172062Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.130", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.38", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon OAuth", "versions": [{"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.83", "versionType": "custom"}, {"status": "affected", "version": "7.0.259", "lessThan": "7.0.259.31", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth", "defaultStatus": "unknown"}]}], "published": "2026-08-06T08:16:28.063", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor."}], "lastModified": "2026-08-10T14:17:20.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D06E76F-D338-474A-A04E-71D9440E48E6", "versionEndExcluding": "7.0.0.130", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A73495D-37B9-498F-8FB5-4A0B6E121B76", "versionEndExcluding": "7.1.0.38", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}