CVE-2025-13173
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
- Published
- Updated
- Reserved
- Assigned by
- WSO2
Description
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Timeline
ID reserved
By WSO2
- 11 months later
· 11 months later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.19% · top 91% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
- unknown < 4.5.0
- affected 4.5.0 – < 4.5.0.47
- affected 4.6.0 – < 4.6.0.13
- unknown < 4.5.0
- affected 4.5.0 – < 4.5.0.46
- affected 4.6.0 – < 4.6.0.11
- unknown < 3.1.0
- affected 3.1.0 – < 3.1.0.352
- affected 3.2.0 – < 3.2.0.456
- affected 3.2.1 – < 3.2.1.81
- affected 4.0.0 – < 4.0.0.376
- affected 4.1.0 – < 4.1.0.246
- affected 4.2.0 – < 4.2.0.186
- affected 4.3.0 – < 4.3.0.97
- affected 4.4.0 – < 4.4.0.61
- affected 4.5.0 – < 4.5.0.46
- affected 4.6.0 – < 4.6.0.11
- unknown < 4.5.0
- affected 4.5.0 – < 4.5.0.45
- affected 4.6.0 – < 4.6.0.11
WSO2 · WSO2 Identity Server as Key Manager
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.372
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.421
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.401
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.381
- affected 5.11.0 – < 5.11.0.428
- affected 6.0.0 – < 6.0.0.255
- affected 6.1.0 – < 6.1.0.256
- affected 7.0.0 – < 7.0.0.133
- affected 7.1.0 – < 7.1.0.41
- affected 7.2.0 – < 7.2.0.3
- affected 6.4.2 – < 6.4.2.171
- affected 6.4.111 – < 6.4.111.165
- affected 6.4.176 – < 6.4.176.30
- affected 6.4.180 – < 6.4.180.14
- affected 6.8.0 – < 6.8.0.54
- affected 6.9.6 – < 6.9.6.29
- affected 6.11.21 – < 6.11.21.94
- affected 6.13.16 – < 6.13.16.21
- affected 6.13.19 – < 6.13.19.14
- affected 6.13.27 – < 6.13.27.10
- affected 6.13.41 – < 6.13.41.1
- affected 7.0.26 – < 7.0.26.87
- affected 7.0.259 – < 7.0.259.34
- affected 7.0.385 – < 7.0.385.3
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-13173)Record last updated .