CVE-2025-12627

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::

History

29 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) El flujo de suplantación de identidad de usuario en WSO2 Identity Server no gestiona adecuadamente los tokens de actualización asociados con sesiones suplantadas. Esto permite a un atacante que ha obtenido un token de acceso para un usuario suplantado aprovechar la concesión de token de actualización para obtener nuevos tokens de acceso, extendiendo su capacidad para actuar como el usuario legítimo. Un atacante que obtiene acceso al token de acceso de un usuario suplantado puede explotar esta debilidad para renovar su autorización. Esto resulta en la capacidad continua de realizar acciones en nombre del usuario real, comprometiendo la integridad y trazabilidad del registro al enmascarar al verdadero actor.

Information

Published : 2026-08-06 08:16

Updated : 2026-09-29 14:10

NVD link : CVE-2025-12627

Mitre link : CVE-2025-12627

CVE.ORG link : CVE-2025-12627

JSON object : View

Products Affected

wso2

identity_server

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-12627", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12627", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:33:32.172062Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.130", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.38", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon OAuth", "versions": [{"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.83", "versionType": "custom"}, {"status": "affected", "version": "7.0.259", "lessThan": "7.0.259.31", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth", "defaultStatus": "unknown"}]}], "published": "2026-08-06T08:16:28.063", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor."}, {"lang": "es", "value": "El flujo de suplantaci\u00f3n de identidad de usuario en WSO2 Identity Server no gestiona adecuadamente los tokens de actualizaci\u00f3n asociados con sesiones suplantadas. Esto permite a un atacante que ha obtenido un token de acceso para un usuario suplantado aprovechar la concesi\u00f3n de token de actualizaci\u00f3n para obtener nuevos tokens de acceso, extendiendo su capacidad para actuar como el usuario leg\u00edtimo.\n\nUn atacante que obtiene acceso al token de acceso de un usuario suplantado puede explotar esta debilidad para renovar su autorizaci\u00f3n. Esto resulta en la capacidad continua de realizar acciones en nombre del usuario real, comprometiendo la integridad y trazabilidad del registro al enmascarar al verdadero actor."}], "lastModified": "2026-09-29T14:10:00.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D06E76F-D338-474A-A04E-71D9440E48E6", "versionEndExcluding": "7.0.0.130", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A73495D-37B9-498F-8FB5-4A0B6E121B76", "versionEndExcluding": "7.1.0.38", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}