CVE-2024-8995
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.
| CWE | CWE-613 |
| Vendor | wso2 |
| Product | wso2 api manager |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 api manager
Be the first to know when new medium vulnerabilities affecting wso2 wso2 api manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WSO2 / WSO2 API Manager
3.1.0 < 3.1.0.320 3.2.0 < 3.2.0.413 3.2.1 < 3.2.1.90 4.0.0 < 4.0.0.334 4.1.0 < 4.1.0.255 4.2.0 < 4.2.0.195 4.3.0 < 4.3.0.106 4.4.0 < 4.4.0.70 4.5.0 < 4.5.0.55 4.6.0 < 4.6.0.19
WSO2 / WSO2 Traffic Manager
4.5.0 < 4.5.0.54 4.6.0 < 4.6.0.19
WSO2 / WSO2 API Control Plane
4.5.0 < 4.5.0.56 4.6.0 < 4.6.0.20
WSO2 / WSO2 Universal Gateway
4.5.0 < 4.5.0.55 4.6.0 < 4.6.0.19
WSO2 / WSO2 Open Banking AM
2.0.0 < 2.0.0.369
WSO2 / WSO2 Identity Server
5.10.0 < 5.10.0.345 5.11.0 < 5.11.0.395 6.0.0 < 6.0.0.229 6.1.0 < 6.1.0.208
WSO2 / WSO2 Open Banking IAM
2.0.0 < 2.0.0.389
WSO2 / WSO2 Identity Server as Key Manager
5.10.0 < 5.10.0.338
WSO2 / WSO2 Carbon OAuth
6.4.2 < 6.4.2.154 6.4.111 < 6.4.111.131 6.4.176 < 6.4.176.35 6.4.180 < 6.4.180.17 6.8.0 < 6.8.0.46 6.9.6 < 6.9.6.34 6.11.21 < 6.11.21.59 6.13.16 < 6.13.16.27 6.13.19 < 6.13.19.19 6.13.27 < 6.13.27.15 6.13.41 < 6.13.41.4