WSO2 Identity Server CVE-2025-12627

The WSO2 Identity Server user impersonation feature must be enabled and the attacker must hold high-privilege credentials sufficient to initiate an impersonation session (PR:H). The attacker must operate from an adjacent network segment (AV:A) - internet-based remote exploitation is not supported by the CVSS vector. Crucially, the attacker must have already successfully initiated an impersonation session and obtained the resulting access token; the vulnerability is in what happens after that token expires, not in the impersonation initiation itself. Factors limiting exploitation: the high privilege bar for impersonation blocks low-privilege or unauthenticated attackers entirely; adjacent network access excludes internet-scale opportunistic exploitation; and impact is confined to integrity and audit log corruption with no confidentiality or availability consequence, limiting usefulness to actors seeking attribution evasion rather than data theft.

The vendor-assigned CVSS base score of 2.4 (AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) accurately constrains real-world risk. Two hard prerequisites block broad exploitation: the attacker must operate from an adjacent network segment (AV:A, ruling out internet-scale attacks) and must already hold high-privilege credentials sufficient to invoke the impersonation feature (PR:H). The impact is limited to integrity (I:L) with no confidentiality or availability consequence, reflecting audit log corruption rather than data exfiltration or service disruption. No EPSS score was provided in the input, and the CVE is not listed in the CISA KEV catalog. No public exploit code has been identified. The practical threat model is narrow: a malicious insider, a compromised administrator account, or a red-team actor who has already escalated to admin-level access. For organizations relying on WSO2 impersonation audit trails for regulatory compliance or incident response forensics, the integrity and traceability impact carries disproportionate operational significance relative to the low numeric CVSS score.

A malicious administrator or attacker who has compromised an admin account on an adjacent network segment invokes WSO2 Identity Server's impersonation feature to obtain an access token for a target user. When the impersonation session is intended to conclude - whether by timeout or manual termination - the attacker retains the associated refresh token and submits it against the OAuth token endpoint to obtain a fresh access token, silently extending unauthorized access. All subsequent actions performed against WSO2-protected resources appear in audit logs under the victim's identity, with no record linking them to the true actor or the original impersonation event.