CVE-2024-9517
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
| CWE | CWE-613 |
| Vendor | wso2 |
| Product | wso2 api manager |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 api manager
Be the first to know when new medium vulnerabilities affecting wso2 wso2 api manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WSO2 / WSO2 API Manager
3.1.0 < 3.1.0.308 3.2.0 < 3.2.0.429 3.2.1 < 3.2.1.49 4.0.0 < 4.0.0.315 4.1.0 < 4.1.0.214 4.2.0 < 4.2.0.149 4.3.0 < 4.3.0.62 4.4.0 < 4.4.0.25 4.5.0 < 4.5.0.9
WSO2 / WSO2 Universal Gateway
4.5.0 < 4.5.0.9
WSO2 / WSO2 Traffic Manager
4.5.0 < 4.5.0.9
WSO2 / WSO2 API Control Plane
4.5.0 < 4.5.0.10
WSO2 / WSO2 Identity Server as Key Manager
5.10.0 < 5.10.0.324
WSO2 / WSO2 Identity Server
5.10.0 < 5.10.0.331 5.11.0 < 5.11.0.376 6.0.0 < 6.0.0.219 6.1.0 < 6.1.0.205 7.0.0 < 7.0.0.73
WSO2 / WSO2 Open Banking AM
2.0.0 < 2.0.0.357
WSO2 / WSO2 Open Banking IAM
2.0.0 < 2.0.0.377
WSO2 / WSO2 Carbon OAuth
6.4.2 < 6.4.2.148 6.4.111 < 6.4.111.122 6.4.176 < 6.4.176.26 6.4.180 < 6.4.180.10 6.8.0 < 6.8.0.44 6.9.6 < 6.9.6.21 6.11.21 < 6.11.21.64 6.13.16 < 6.13.16.13 6.13.19 < 6.13.19.7 6.13.27 < 6.13.27.1 7.0.26 < 7.0.26.37