WSO2 API Manager CVE-2026-3583

Exploitation requires the allowed_scopes configuration to be enabled on the affected WSO2 product - this is the exact prerequisite named in the advisory; default deployments without this setting are not affected. The attacker must be an authenticated OAuth2 client (CVSS PR:L) able to call both the token introspection and token revocation endpoints, and must hit a narrow ordering window where a token is introspected immediately before its revocation request (reflected as AC:H). Limiting factors: no confidentiality or integrity impact is possible (C:N/I:N), the re-issued token is rejected for API authorization, the effect lasts only for the cache lifetime until the entry is cleared, and the condition depends on a non-default configuration plus valid client credentials.

This is a low-severity, low-priority issue and the signals are internally consistent. The vendor-supplied CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L, base 3.1) describes a network-reachable but authenticated (PR:L) flaw with high attack complexity (AC:H) whose only impact is a low availability effect (C:N, I:N, A:L) - no confidentiality or integrity loss. The vuln.today Decision label is 'monitor', the lowest urgency tier, and there is no CISA KEV listing, no EPSS score supplied, and no public exploit identified at time of analysis. All signals agree: this is a correctness/availability defect in OAuth2 token-revocation caching, not a security-critical access-control bypass. The description explicitly states the re-issued token is NOT honored for API authorization, so the real-world harm is limited to a transient authentication-flow disruption rather than unauthorized access. Note one data gap: EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified, but given AC:H, PR:L and availability-only impact the practical attacker incentive is minimal.

An authenticated OAuth2 client, with the allowed_scopes configuration enabled on an affected WSO2 deployment, introspects an access token and then immediately issues a revocation request for it. Because of the narrow timing window, the revoked token can be served again from the introspection cache until the cache entry expires, leaving the affected user temporarily unable to obtain a fresh valid token. No public exploit identified at time of analysis; realistic abuse is a self-inflicted or narrowly-timed denial of a new token rather than privilege escalation.