3.1
LowCVSS 3.1 · from WSO2
CVE-2026-3583
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
WSO2 API Manager · CWE-613 · CWE-613AffectedWSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway and 6 more
FixUpdate to 3.1.0.367, 3.2.0.475, 3.2.1.106, 4.0.0.394 or newer
PublishedOct 28, 19:21 · WSO2
ScoredOct 28 · 3.1 · WSO2
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
From WSO2
Affected and fixed versions
ProductAffectedFixed inWSO2 API Manager3.1.0 – before 3.1.0.3673.1.0.367WSO2 API Manager3.2.0 – before 3.2.0.4753.2.0.475WSO2 API Manager3.2.1 – before 3.2.1.1063.2.1.106WSO2 API Manager4.0.0 – before 4.0.0.3944.0.0.394WSO2 API Manager4.1.0 – before 4.1.0.2674.1.0.267WSO2 API Manager4.2.0 – before 4.2.0.2074.2.0.207WSO2 API Manager4.3.0 – before 4.3.0.1204.3.0.120WSO2 API Manager4.4.0 – before 4.4.0.834.4.0.83WSO2 API Manager4.5.0 – before 4.5.0.674.5.0.67WSO2 API Manager4.6.0 – before 4.6.0.294.6.0.29WSO2 API Manager4.7.0 – before 4.7.0.34.7.0.3WSO2 Traffic Manager4.5.0 – before 4.5.0.654.5.0.65WSO2 Traffic Manager4.6.0 – before 4.6.0.294.6.0.29WSO2 Traffic Manager4.7.0 – before 4.7.0.34.7.0.3WSO2 Universal Gateway4.5.0 – before 4.5.0.674.5.0.67WSO2 Universal Gateway4.6.0 – before 4.6.0.294.6.0.29WSO2 Universal Gateway4.7.0 – before 4.7.0.34.7.0.3WSO2 API Control Plane4.5.0 – before 4.5.0.684.5.0.68WSO2 API Control Plane4.6.0 – before 4.6.0.304.6.0.30WSO2 API Control Plane4.7.0 – before 4.7.0.34.7.0.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known