Wso2 Carbon Oauth (Wso2) - vulnerabilities (CVEs)

5 CVEs, 3 in the last 30 days, 2 known versions, newest CVE from 2026-10-28. Vendor: Wso2.

CVEs of Wso2 Carbon Oauth

• CVE-2026-6647 - CVSS 7.4 (high), 2026-10-28: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username…
• CVE-2026-3583 - CVSS 3.1 (low), 2026-10-28: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a…
• CVE-2025-0326, 2026-10-21: The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password…
• CVE-2025-13173 - CVSS 6.5 (medium), 2026-10-19: Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs…
• CVE-2025-12627 - CVSS 2.4 (low), 2026-08-06: The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who…
• CVE-2024-8995 - CVSS 4.9 (medium), 2026-08-06: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these…