EUVD-2025-210629
GHSA-8j24-697m-8w28
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
High privileges required to invoke impersonation (PR:H); adjacent vector reflects admin session context; integrity-only impact captures audit corruption with no data disclosure.
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
2DescriptionCVE.org
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.
An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.
AnalysisAI
Insufficient refresh token invalidation in WSO2 Identity Server's user impersonation flow allows a privileged attacker who has already obtained an impersonated access token to silently renew that authorization via the OAuth refresh token grant, sustaining unauthorized access well beyond the intended session lifetime. The integrity impact is two-fold: the attacker continues performing actions on behalf of the legitimate user, and audit logs attribute those actions to the victim identity rather than the true actor, corrupting traceability and compliance posture. No public exploit is identified and exploitation is bounded by high privilege prerequisites (PR:H) and adjacent network access (AV:A), placing realistic risk firmly in insider-threat and compromised-administrator scenarios.
Technical ContextAI
WSO2 Identity Server is an enterprise identity and access management platform implementing OAuth 2.0 token flows, including a user impersonation capability that allows privileged administrators to act on behalf of other users. The affected component is WSO2 Carbon OAuth (cpe:2.3:a:wso2:wso2_carbon_oauth), the underlying OAuth 2.0 engine embedded in WSO2 Identity Server (cpe:2.3:a:wso2:wso2_identity_server). CWE-613 (Insufficient Session Expiration) identifies the root cause: when an impersonated access token expires or the impersonation session is administratively terminated, the refresh tokens bound to that impersonation context are not properly scoped or invalidated. This allows the attacker to submit a standard OAuth refresh token grant request - an operation not typically audited with the same scrutiny as impersonation initiation - to silently obtain new access tokens and perpetuate the impersonated session without detection.
RemediationAI
Patch available per vendor advisory - consult the WSO2 security advisory WSO2-2025-4619 at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/ for specific patched versions and upgrade procedures, as exact fixed version numbers are not independently confirmable from available CPE data. Pending patch application, administrators should configure the shortest operationally acceptable refresh token lifetime for impersonation sessions within WSO2 Identity Server's OAuth settings, reducing the window during which a stale refresh token can be leveraged. Enabling active token revocation on impersonation session termination - if configurable in the deployed version - closes the gap directly. Audit logging for refresh token grant requests should be enhanced to flag token renewals originating from impersonation-scoped sessions, enabling detection of exploitation attempts. The impersonation feature itself should be restricted to the minimum required set of administrators, reducing the blast radius of a compromised privileged account.
More in Wso2 Identity Server
View allAuthentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated att
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Modul
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentica
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are n
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segrega
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today