{"schema":"threatline.record/2","record":{"id":"CVE-2026-3583","aliases":[],"summary":"Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]","details":"When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.\n\nThe security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.","categories":["Unclassified"],"product":"WSO2 API Manager","vendor":"WSO2","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"3.1.0","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.367","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.475","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.106","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.394","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.267","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.207","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.120","versionType":"custom"},{"status":"affected","version":"4.4.0","lessThan":"4.4.0.83","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.67","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.29","versionType":"custom"},{"status":"affected","version":"4.7.0","lessThan":"4.7.0.3","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.65","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.29","versionType":"custom"},{"status":"affected","version":"4.7.0","lessThan":"4.7.0.3","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.67","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.29","versionType":"custom"},{"status":"affected","version":"4.7.0","lessThan":"4.7.0.3","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.68","versionType":"custom"},{"status":"affected","version":"4.6.0","lessThan":"4.6.0.30","versionType":"custom"},{"status":"affected","version":"4.7.0","lessThan":"4.7.0.3","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.397","versionType":"custom"},{"status":"affected","version":"5.11.0","lessThan":"5.11.0.444","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.270","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.269","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.152","versionType":"custom"},{"status":"affected","version":"7.1.0","lessThan":"7.1.0.61","versionType":"custom"},{"status":"affected","version":"7.2.0","lessThan":"7.2.0.20","versionType":"custom"},{"status":"affected","version":"7.3.0","lessThan":"7.3.0.1","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.434","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.387","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.414","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Carbon OAuth","vendor":"WSO2","versions":[{"status":"affected","version":"6.4.2","lessThan":"6.4.2.178","versionType":"custom"},{"status":"affected","version":"6.4.111","lessThan":"6.4.111.174","versionType":"custom"},{"status":"affected","version":"6.4.176","lessThan":"6.4.176.38","versionType":"custom"},{"status":"affected","version":"6.4.180","lessThan":"6.4.180.25","versionType":"custom"},{"status":"affected","version":"6.8.0","lessThan":"6.8.0.59","versionType":"custom"},{"status":"affected","version":"6.9.6","lessThan":"6.9.6.36","versionType":"custom"},{"status":"affected","version":"6.11.21","lessThan":"6.11.21.118","versionType":"custom"},{"status":"affected","version":"6.13.16","lessThan":"6.13.16.32","versionType":"custom"},{"status":"affected","version":"6.13.19","lessThan":"6.13.19.23","versionType":"custom"},{"status":"affected","version":"6.13.27","lessThan":"6.13.27.21","versionType":"custom"},{"status":"affected","version":"6.13.41","lessThan":"6.13.41.9","versionType":"custom"},{"status":"affected","version":"6.14.14","lessThan":"6.14.14.3","versionType":"custom"},{"status":"affected","version":"7.0.26","lessThan":"7.0.26.103","versionType":"custom"},{"status":"affected","version":"7.0.259","lessThan":"7.0.259.54","versionType":"custom"},{"status":"affected","version":"7.0.385","lessThan":"7.0.385.15","versionType":"custom"},{"status":"affected","version":"7.4.99","lessThan":"7.4.99.5","versionType":"custom"},{"status":"unaffected","version":"7.5.78","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.1.0.367","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.0.475","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.1.106","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.0.0.394","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.1.0.267","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.2.0.207","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.3.0.120","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.4.0.83","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.5.0.67","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.6.0.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.7.0.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Traffic Manager","ecosystem":null},"version":"4.5.0.65","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Traffic Manager","ecosystem":null},"version":"4.6.0.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Traffic Manager","ecosystem":null},"version":"4.7.0.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Universal Gateway","ecosystem":null},"version":"4.5.0.67","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Universal Gateway","ecosystem":null},"version":"4.6.0.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Universal Gateway","ecosystem":null},"version":"4.7.0.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Control Plane","ecosystem":null},"version":"4.5.0.68","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Control Plane","ecosystem":null},"version":"4.6.0.30","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Control Plane","ecosystem":null},"version":"4.7.0.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.10.0.397","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.11.0.444","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.0.0.270","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.1.0.269","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.0.0.152","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.1.0.61","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.2.0.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.3.0.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Open Banking IAM","ecosystem":null},"version":"2.0.0.434","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server as Key Manager","ecosystem":null},"version":"5.10.0.387","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Open Banking AM","ecosystem":null},"version":"2.0.0.414","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.4.2.178","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.4.111.174","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.4.176.38","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.4.180.25","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.8.0.59","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.9.6.36","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.11.21.118","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.13.16.32","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.13.19.23","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.13.27.21","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.13.41.9","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"6.14.14.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"7.0.26.103","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"7.0.259.54","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"7.0.385.15","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","source_modified_at":"2026-10-28T19:21:34.577Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon OAuth","ecosystem":null},"version":"7.4.99.5","basis":"first unaffected version stated in the CVE record"}],"cvss":3.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T19:21:34.577Z","modified_at":"2026-10-28T19:21:34.577Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-3583","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:21:34.577Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T19:21:34.577Z","content_hash":"e6daeadbd30ace35ca12d387461521f9f25050531249db33c99e6162b7d74a26"}}