CVE-2026-3583Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Açıklama
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.68, 4.6.0 – < 4.6.0.30, 4.7.0 – < 4.7.0.3 | |
| WSO2 | WSO2 API Manager | 3.1.0 – < 3.1.0.367, 3.2.0 – < 3.2.0.475, 3.2.1 – < 3.2.1.106, 4.0.0 – < 4.0.0.394, 4.1.0 – < 4.1.0.267, 4.2.0 – < 4.2.0.207, 4.3.0 – < 4.3.0.120, 4.4.0 – < 4.4.0.83, 4.5.0 – < 4.5.0.67, 4.6.0 – < 4.6.0.29, 4.7.0 – < 4.7.0.3 | |
| WSO2 | WSO2 Carbon OAuth | 6.4.2 – < 6.4.2.178, 6.4.111 – < 6.4.111.174, 6.4.176 – < 6.4.176.38, 6.4.180 – < 6.4.180.25, 6.8.0 – < 6.8.0.59, 6.9.6 – < 6.9.6.36, 6.11.21 – < 6.11.21.118, 6.13.16 – < 6.13.16.32, 6.13.19 – < 6.13.19.23, 6.13.27 – < 6.13.27.21, 6.13.41 – < 6.13.41.9, 6.14.14 – < 6.14.14.3, 7.0.26 – < 7.0.26.103, 7.0.259 – < 7.0.259.54, 7.0.385 – < 7.0.385.15, 7.4.99 – < 7.4.99.5 | |
| WSO2 | WSO2 Identity Server | 5.10.0 – < 5.10.0.397, 5.11.0 – < 5.11.0.444, 6.0.0 – < 6.0.0.270, 6.1.0 – < 6.1.0.269, 7.0.0 – < 7.0.0.152, 7.1.0 – < 7.1.0.61, 7.2.0 – < 7.2.0.20, 7.3.0 – < 7.3.0.1 | |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 – < 5.10.0.387 | |
| WSO2 | WSO2 Open Banking AM | 2.0.0 – < 2.0.0.414 | |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.434 | |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.65, 4.6.0 – < 4.6.0.29, 4.7.0 – < 4.7.0.3 | |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.67, 4.6.0 – < 4.6.0.29, 4.7.0 – < 4.7.0.3 |