Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.

This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 API Control Plane unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.47
4.6.0 affected < 4.6.0.13
WSO2 WSO2 Universal Gateway unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.46
4.6.0 affected < 4.6.0.11
WSO2 WSO2 API Manager unaffected
Version Status Constraints
0 unknown < 3.1.0
3.1.0 affected < 3.1.0.352
3.2.0 affected < 3.2.0.456
3.2.1 affected < 3.2.1.81
4.0.0 affected < 4.0.0.376
4.1.0 affected < 4.1.0.246
4.2.0 affected < 4.2.0.186
4.3.0 affected < 4.3.0.97
4.4.0 affected < 4.4.0.61
4.5.0 affected < 4.5.0.46
4.6.0 affected < 4.6.0.11
WSO2 WSO2 Traffic Manager unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.45
4.6.0 affected < 4.6.0.11
WSO2 WSO2 Identity Server as Key Manager unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.372
WSO2 WSO2 Open Banking IAM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.421
WSO2 WSO2 Open Banking AM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.401
WSO2 WSO2 Identity Server unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.381
5.11.0 affected < 5.11.0.428
6.0.0 affected < 6.0.0.255
6.1.0 affected < 6.1.0.256
7.0.0 affected < 7.0.0.133
7.1.0 affected < 7.1.0.41
7.2.0 affected < 7.2.0.3
WSO2 WSO2 Carbon OAuth unknown
Version Status Constraints
6.4.2 affected < 6.4.2.171
6.4.111 affected < 6.4.111.165
6.4.176 affected < 6.4.176.30
6.4.180 affected < 6.4.180.14
6.8.0 affected < 6.8.0.54
6.9.6 affected < 6.9.6.29
6.11.21 affected < 6.11.21.94
6.13.16 affected < 6.13.16.21
6.13.19 affected < 6.13.19.14
6.13.27 affected < 6.13.27.10
6.13.41 affected < 6.13.41.1
7.0.26 affected < 7.0.26.87
7.0.259 affected < 7.0.259.34
7.0.385 affected < 7.0.385.3

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Wso2 Subscribe
Identity Server Subscribe
Wso2 Api Control Plane Subscribe
Wso2 Api Manager Subscribe
Wso2 Carbon Oauth Subscribe
Wso2 Identity Server Subscribe
Wso2 Identity Server As Key Manager Subscribe
Wso2 Open Banking Am Subscribe
Wso2 Open Banking Iam Subscribe
Wso2 Traffic Manager Subscribe
Wso2 Universal Gateway Subscribe

Project Subscriptions

Vendors Products
Wso2 Subscribe
Identity Server Subscribe
Wso2 Api Control Plane Subscribe
Wso2 Api Manager Subscribe
Wso2 Carbon Oauth Subscribe
Wso2 Identity Server Subscribe
Wso2 Identity Server As Key Manager Subscribe
Wso2 Open Banking Am Subscribe
Wso2 Open Banking Iam Subscribe
Wso2 Traffic Manager Subscribe
Wso2 Universal Gateway Subscribe
Advisories

No advisories yet.

Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/ cve-icon cve-icon
History

Mon, 19 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Wso2 identity Server
Vendors & Products Wso2 identity Server

Mon, 19 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Title Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
First Time appeared Wso2
Wso2 wso2 Api Control Plane
Wso2 wso2 Api Manager
Wso2 wso2 Carbon Oauth
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Am
Wso2 wso2 Open Banking Iam
Wso2 wso2 Traffic Manager
Wso2 wso2 Universal Gateway
Weaknesses CWE-613
CPEs cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*
Vendors & Products Wso2
Wso2 wso2 Api Control Plane
Wso2 wso2 Api Manager
Wso2 wso2 Carbon Oauth
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Am
Wso2 wso2 Open Banking Iam
Wso2 wso2 Traffic Manager
Wso2 wso2 Universal Gateway
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-10-19T16:49:08.687Z

Reserved: 2025-11-14T10:17:18.989Z

Link: CVE-2025-13173

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-19T17:16:59.183

Modified: 2026-10-19T21:06:28.507

Link: CVE-2025-13173

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T20:45:03Z

Weaknesses