CVE-2026-3583
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- Published
- Updated
- Reserved
- Assigned by
- WSO2
Description
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Low3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Low3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.1.
Weakness
Affected products
- unknown < 3.1.0
- affected 3.1.0 – < 3.1.0.367
- affected 3.2.0 – < 3.2.0.475
- affected 3.2.1 – < 3.2.1.106
- affected 4.0.0 – < 4.0.0.394
- affected 4.1.0 – < 4.1.0.267
- affected 4.2.0 – < 4.2.0.207
- affected 4.3.0 – < 4.3.0.120
- affected 4.4.0 – < 4.4.0.83
- affected 4.5.0 – < 4.5.0.67
- affected 4.6.0 – < 4.6.0.29
- affected 4.7.0 – < 4.7.0.3
- unknown < 4.5.0
- affected 4.5.0 – < 4.5.0.65
- affected 4.6.0 – < 4.6.0.29
- affected 4.7.0 – < 4.7.0.3
- unknown < 4.5.0
- affected 4.5.0 – < 4.5.0.67
- affected 4.6.0 – < 4.6.0.29
- affected 4.7.0 – < 4.7.0.3
- unknown < 4.5.0
- affected 4.5.0 – < 4.5.0.68
- affected 4.6.0 – < 4.6.0.30
- affected 4.7.0 – < 4.7.0.3
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.397
- affected 5.11.0 – < 5.11.0.444
- affected 6.0.0 – < 6.0.0.270
- affected 6.1.0 – < 6.1.0.269
- affected 7.0.0 – < 7.0.0.152
- affected 7.1.0 – < 7.1.0.61
- affected 7.2.0 – < 7.2.0.20
- affected 7.3.0 – < 7.3.0.1
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.434
WSO2 · WSO2 Identity Server as Key Manager
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.387
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.414
- affected 6.4.2 – < 6.4.2.178
- affected 6.4.111 – < 6.4.111.174
- affected 6.4.176 – < 6.4.176.38
- affected 6.4.180 – < 6.4.180.25
- affected 6.8.0 – < 6.8.0.59
- affected 6.9.6 – < 6.9.6.36
- affected 6.11.21 – < 6.11.21.118
- affected 6.13.16 – < 6.13.16.32
- affected 6.13.19 – < 6.13.19.23
- affected 6.13.27 – < 6.13.27.21
- affected 6.13.41 – < 6.13.41.9
- affected 6.14.14 – < 6.14.14.3
- affected 7.0.26 – < 7.0.26.103
- affected 7.0.259 – < 7.0.259.54
- affected 7.0.385 – < 7.0.385.15
- affected 7.4.99 – < 7.4.99.5
- unaffected 7.5.78 – ≤ *
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-3583)Record last updated .