CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

State: Published
Severity: 3.1 Low
Published: Oct 28, 2026
Updated: Oct 29, 2026
Reserved: Mar 5, 2026

Description

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.

The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L	WSO2

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.367Affected 3.2.0 to before 3.2.0.475Affected 3.2.1 to before 3.2.1.106Affected 4.0.0 to before 4.0.0.394Affected 4.1.0 to before 4.1.0.267Affected 4.2.0 to before 4.2.0.207Affected 4.3.0 to before 4.3.0.120Affected 4.4.0 to before 4.4.0.83Affected 4.5.0 to before 4.5.0.67Affected 4.6.0 to before 4.6.0.29Affected 4.7.0 to before 4.7.0.3Affected
WSO2 Traffic ManagerWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.65Affected 4.6.0 to before 4.6.0.29Affected 4.7.0 to before 4.7.0.3Affected
WSO2 Universal GatewayWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.67Affected 4.6.0 to before 4.6.0.29Affected 4.7.0 to before 4.7.0.3Affected
WSO2 API Control PlaneWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.68Affected 4.6.0 to before 4.6.0.30Affected 4.7.0 to before 4.7.0.3Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.397Affected 5.11.0 to before 5.11.0.444Affected 6.0.0 to before 6.0.0.270Affected 6.1.0 to before 6.1.0.269Affected 7.0.0 to before 7.0.0.152Affected 7.1.0 to before 7.1.0.61Affected 7.2.0 to before 7.2.0.20Affected 7.3.0 to before 7.3.0.1Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.434Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.387Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.414Affected
WSO2 Carbon OAuthWSO2	6.4.2 to before 6.4.2.178Affected 6.4.111 to before 6.4.111.174Affected 6.4.176 to before 6.4.176.38Affected 6.4.180 to before 6.4.180.25Affected 6.8.0 to before 6.8.0.59Affected 6.9.6 to before 6.9.6.36Affected 6.11.21 to before 6.11.21.118Affected 6.13.16 to before 6.13.16.32Affected 6.13.19 to before 6.13.19.23Affected 6.13.27 to before 6.13.27.21Affected 6.13.41 to before 6.13.41.9Affected 6.14.14 to before 6.14.14.3Affected 7.0.26 to before 7.0.26.103Affected 7.0.259 to before 7.0.259.54Affected 7.0.385 to before 7.0.385.15Affected 7.4.99 to before 7.4.99.5Affected 7.5.78 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.