What’s Vulnerable › Vulnerabilities

CVE-2026-3583: Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Description

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Affected products

How to fix

Upgrade to a fixed version: WSO2 Api Control Plane 4.5.0.68, 4.6.0.30, 4.7.0.3; WSO2 API Manager 3.1.0.367, 3.2.0.475, 3.2.1.106, 4.0.0.394; WSO2 Identity Server 5.10.0.397, 5.11.0.444, 6.0.0.270, 6.1.0.269; WSO2 Identity Server As Key Manager 5.10.0.387; WSO2 Open Banking Am 2.0.0.414; WSO2 Open Banking Iam 2.0.0.434; WSO2 Traffic Manager 4.5.0.65, 4.6.0.29, 4.7.0.3; WSO2 Universal Gateway 4.5.0.67, 4.6.0.29, 4.7.0.3; WSO2 Carbon OAuth 6.4.2.178, 6.4.111.174, 6.4.176.38, 6.4.180.25. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-3583 or the next vulnerability affects your stack