EUVD-2025-210646
GHSA-257q-prhp-qgwp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
PR:L reflects prior authentication required; AC:H captures the role-revocation timing dependency; C/I/A:L as access is bounded by previously held role scope.
Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).
CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8
Lifecycle Timeline
2DescriptionCVE.org
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.
This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.
AnalysisAI
Token invalidation failure in WSO2 products allows authenticated users whose internal roles have been revoked to retain those privileges until their existing tokens naturally expire. The flaw means that administrative role-removal actions have no immediate security effect - a revoked user continues to hold a valid, exploitable credential granting access to resources they are no longer authorized to reach. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV, but the business impact of failed privilege revocation can be significant in environments where timely access termination is a compliance requirement.
Technical ContextAI
CWE-613 (Insufficient Session Expiration) describes failures in the token lifecycle management layer, specifically the absence of server-side token invalidation upon permission changes. In OAuth 2.0 and OIDC-based identity platforms like WSO2 Identity Server or WSO2 API Manager, issued tokens (JWT access tokens, refresh tokens, or opaque session tokens) carry embedded claims including role/group memberships. When the identity store removes a role from a user, a correctly implemented system must actively revoke or invalidate all outstanding tokens for that user - either by revoking individual tokens, updating a token blacklist, or invalidating the session. WSO2's affected product omits this step, meaning the role-claim embedded in previously issued tokens remains valid until the token's natural TTL elapses. The CVSS vector (AV:N/AC:H/PR:L) confirms network exploitability by an already-authenticated user under high-complexity conditions (timing around role revocation).
RemediationAI
Consult WSO2 Security Advisory WSO2-2025-4672 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4672/) for the official patch and exact fixed versions - no specific patched version number was included in the provided intelligence. As a compensating control pending patching, administrators should reduce token TTL values to the shortest operationally acceptable window, limiting the exploitable period after role revocation. Where WSO2 supports explicit token revocation APIs or session management endpoints, integrate role-removal workflows with a token revocation call for the affected user. Additionally, enforce token introspection on protected resources rather than relying solely on embedded claims, so that authorization decisions reflect live identity state. Note that reducing token TTL increases re-authentication frequency and may impact user experience in high-activity environments.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today