Riskcovery

CVE-2025-13173

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

State
Published
Severity
6.5 Medium
Published
Oct 19, 2026
Updated
Oct 20, 2026
Reserved
Nov 14, 2025

Read the record on cve.org

Description

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.

This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LWSO2

Weaknesses

  • CWE-613 Insufficient Session Expiration

Affected Products

ProductVersions
WSO2 API Control PlaneWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.47Affected
  • 4.6.0 to before 4.6.0.13Affected
WSO2 Universal GatewayWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.46Affected
  • 4.6.0 to before 4.6.0.11Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.352Affected
  • 3.2.0 to before 3.2.0.456Affected
  • 3.2.1 to before 3.2.1.81Affected
  • 4.0.0 to before 4.0.0.376Affected
  • 4.1.0 to before 4.1.0.246Affected
  • 4.2.0 to before 4.2.0.186Affected
  • 4.3.0 to before 4.3.0.97Affected
  • 4.4.0 to before 4.4.0.61Affected
  • 4.5.0 to before 4.5.0.46Affected
  • 4.6.0 to before 4.6.0.11Affected
WSO2 Traffic ManagerWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.45Affected
  • 4.6.0 to before 4.6.0.11Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.372Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.421Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.401Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.381Affected
  • 5.11.0 to before 5.11.0.428Affected
  • 6.0.0 to before 6.0.0.255Affected
  • 6.1.0 to before 6.1.0.256Affected
  • 7.0.0 to before 7.0.0.133Affected
  • 7.1.0 to before 7.1.0.41Affected
  • 7.2.0 to before 7.2.0.3Affected
WSO2 Carbon OAuthWSO2
  • 6.4.2 to before 6.4.2.171Affected
  • 6.4.111 to before 6.4.111.165Affected
  • 6.4.176 to before 6.4.176.30Affected
  • 6.4.180 to before 6.4.180.14Affected
  • 6.8.0 to before 6.8.0.54Affected
  • 6.9.6 to before 6.9.6.29Affected
  • 6.11.21 to before 6.11.21.94Affected
  • 6.13.16 to before 6.13.16.21Affected
  • 6.13.19 to before 6.13.19.14Affected
  • 6.13.27 to before 6.13.27.10Affected
  • 6.13.41 to before 6.13.41.1Affected
  • 7.0.26 to before 7.0.26.87Affected
  • 7.0.259 to before 7.0.259.34Affected
  • 7.0.385 to before 7.0.385.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.