CVE-2025-12624
Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
CVSS Score
6.0
EPSS Score
0.0%
EPSS Percentile
0th
Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.
| CWE | CWE-613 |
| Vendor | wso2 |
| Product | wso2 identity server |
| Published | Apr 16, 2026 |
| Last Updated | Apr 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 identity server
Be the first to know when new medium vulnerabilities affecting wso2 wso2 identity server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
WSO2 / WSO2 Identity Server
5.2.0 < 5.2.0.35