synced 11 MIN AGO
01 Record

CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

LowPUBLISHEDCNA: WSO2
CNA base score3.1 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
View raw JSON

02 Description

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

03 Exploitation and scoring

Exploitation
Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
SSVC decision
  • ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
  • AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
  • Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
0.26% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 18.3% of scored records. A rank, not a probability.
NVD base score
3.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD analysis status
Awaiting Analysis. NVD last modified this record on 2026-10-29.
Red Hat severity
No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2026-10-28 19:21Z1 DAY AGO
Last updated
2026-10-29 02:02Z23 HR AGO
Reserved
2026-03-05
Assigning CNA
WSO2
Record state
PUBLISHED
Severity
Low (CVSS 3.1)
CNA CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
  • CWE-613Insufficient Session ExpirationBase
Data version
5.2
Document digest
3b3a2e46b5283cf7c0894f14f143e1f45fd2cedb5c2f0fae8db4c14ff1cf4824

05 Affected products

VendorProductVersionsPlatforms
WSO2WSO2 API Manager3.1.0 to < 3.1.0.367, 3.2.0 to < 3.2.0.475, 3.2.1 to < 3.2.1.106, 4.0.0 to < 4.0.0.394, 4.1.0 to < 4.1.0.267, 4.2.0 to < 4.2.0.207, 4.3.0 to < 4.3.0.120, 4.4.0 to < 4.4.0.83, 4.5.0 to < 4.5.0.67, 4.6.0 to < 4.6.0.29, 4.7.0 to < 4.7.0.3—
WSO2WSO2 Traffic Manager4.5.0 to < 4.5.0.65, 4.6.0 to < 4.6.0.29, 4.7.0 to < 4.7.0.3—
WSO2WSO2 Universal Gateway4.5.0 to < 4.5.0.67, 4.6.0 to < 4.6.0.29, 4.7.0 to < 4.7.0.3—
WSO2WSO2 API Control Plane4.5.0 to < 4.5.0.68, 4.6.0 to < 4.6.0.30, 4.7.0 to < 4.7.0.3—
WSO2WSO2 Identity Server5.10.0 to < 5.10.0.397, 5.11.0 to < 5.11.0.444, 6.0.0 to < 6.0.0.270, 6.1.0 to < 6.1.0.269, 7.0.0 to < 7.0.0.152, 7.1.0 to < 7.1.0.61, 7.2.0 to < 7.2.0.20, 7.3.0 to < 7.3.0.1—
WSO2WSO2 Open Banking IAM2.0.0 to < 2.0.0.434—
WSO2WSO2 Identity Server as Key Manager5.10.0 to < 5.10.0.387—
WSO2WSO2 Open Banking AM2.0.0 to < 2.0.0.414—
WSO2WSO2 Carbon OAuth6.4.2 to < 6.4.2.178, 6.4.111 to < 6.4.111.174, 6.4.176 to < 6.4.176.38, 6.4.180 to < 6.4.180.25, 6.8.0 to < 6.8.0.59, 6.9.6 to < 6.9.6.36, 6.11.21 to < 6.11.21.118, 6.13.16 to < 6.13.16.32, 6.13.19 to < 6.13.19.23, 6.13.27 to < 6.13.27.21, 6.13.41 to < 6.13.41.9, 6.14.14 to < 6.14.14.3, 7.0.26 to < 7.0.26.103, 7.0.259 to < 7.0.259.54, 7.0.385 to < 7.0.385.15, 7.4.99 to < 7.4.99.5—

06 References

07 Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution