CVE-2025-13173
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
WSO2 WSO2 API Control Plane
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.5.0.47WSO2 API Control PlaneCVE List
- 4.6.0.13WSO2 API Control PlaneCVE List
- 4.5.0.46WSO2 Universal GatewayCVE List
- 4.6.0.11WSO2 Universal GatewayCVE List
- 3.1.0.352WSO2 API ManagerCVE List
- 3.2.0.456WSO2 API ManagerCVE List
Show all 40 fixed versions
- 3.2.1.81WSO2 API ManagerCVE List
- 4.0.0.376WSO2 API ManagerCVE List
- 4.1.0.246WSO2 API ManagerCVE List
- 4.2.0.186WSO2 API ManagerCVE List
- 4.3.0.97WSO2 API ManagerCVE List
- 4.4.0.61WSO2 API ManagerCVE List
- 4.5.0.46WSO2 API ManagerCVE List
- 4.6.0.11WSO2 API ManagerCVE List
- 4.5.0.45WSO2 Traffic ManagerCVE List
- 4.6.0.11WSO2 Traffic ManagerCVE List
- 5.10.0.372WSO2 Identity Server as Key ManagerCVE List
- 2.0.0.421WSO2 Open Banking IAMCVE List
- 2.0.0.401WSO2 Open Banking AMCVE List
- 5.10.0.381WSO2 Identity ServerCVE List
- 5.11.0.428WSO2 Identity ServerCVE List
- 6.0.0.255WSO2 Identity ServerCVE List
- 6.1.0.256WSO2 Identity ServerCVE List
- 7.0.0.133WSO2 Identity ServerCVE List
- 7.1.0.41WSO2 Identity ServerCVE List
- 7.2.0.3WSO2 Identity ServerCVE List
- 6.4.2.171WSO2 Carbon OAuthCVE List
- 6.4.111.165WSO2 Carbon OAuthCVE List
- 6.4.176.30WSO2 Carbon OAuthCVE List
- 6.4.180.14WSO2 Carbon OAuthCVE List
- 6.8.0.54WSO2 Carbon OAuthCVE List
- 6.9.6.29WSO2 Carbon OAuthCVE List
- 6.11.21.94WSO2 Carbon OAuthCVE List
- 6.13.16.21WSO2 Carbon OAuthCVE List
- 6.13.19.14WSO2 Carbon OAuthCVE List
- 6.13.27.10WSO2 Carbon OAuthCVE List
- 6.13.41.1WSO2 Carbon OAuthCVE List
- 7.0.26.87WSO2 Carbon OAuthCVE List
- 7.0.259.34WSO2 Carbon OAuthCVE List
- 7.0.385.3WSO2 Carbon OAuthCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Text from CVE List
Affected versions 48
- WSO2 API Control Planeunknown: all versions before 4.5.0CVE List
- WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.47CVE List
- WSO2 API Control Planeaffected: 4.6.0 before 4.6.0.13CVE List
- WSO2 Universal Gatewayunknown: all versions before 4.5.0CVE List
- WSO2 Universal Gatewayaffected: 4.5.0 before 4.5.0.46CVE List
- WSO2 Universal Gatewayaffected: 4.6.0 before 4.6.0.11CVE List
- WSO2 API Managerunknown: all versions before 3.1.0CVE List
- WSO2 API Manageraffected: 3.1.0 before 3.1.0.352CVE List
- WSO2 API Manageraffected: 3.2.0 before 3.2.0.456CVE List
- WSO2 API Manageraffected: 3.2.1 before 3.2.1.81CVE List
- WSO2 API Manageraffected: 4.0.0 before 4.0.0.376CVE List
- WSO2 API Manageraffected: 4.1.0 before 4.1.0.246CVE List
- WSO2 API Manageraffected: 4.2.0 before 4.2.0.186CVE List
- WSO2 API Manageraffected: 4.3.0 before 4.3.0.97CVE List
- WSO2 API Manageraffected: 4.4.0 before 4.4.0.61CVE List
- WSO2 API Manageraffected: 4.5.0 before 4.5.0.46CVE List
- WSO2 API Manageraffected: 4.6.0 before 4.6.0.11CVE List
- WSO2 Traffic Managerunknown: all versions before 4.5.0CVE List
- WSO2 Traffic Manageraffected: 4.5.0 before 4.5.0.45CVE List
- WSO2 Traffic Manageraffected: 4.6.0 before 4.6.0.11CVE List
- WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
- WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.372CVE List
- WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
- WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.421CVE List
- WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
- WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.401CVE List
- WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
- WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.381CVE List
- WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.428CVE List
- WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.255CVE List
- WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.256CVE List
- WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.133CVE List
- WSO2 Identity Serveraffected: 7.1.0 before 7.1.0.41CVE List
- WSO2 Identity Serveraffected: 7.2.0 before 7.2.0.3CVE List
- WSO2 Carbon OAuthaffected: 6.4.2 before 6.4.2.171CVE List
- WSO2 Carbon OAuthaffected: 6.4.111 before 6.4.111.165CVE List
- WSO2 Carbon OAuthaffected: 6.4.176 before 6.4.176.30CVE List
- WSO2 Carbon OAuthaffected: 6.4.180 before 6.4.180.14CVE List
- WSO2 Carbon OAuthaffected: 6.8.0 before 6.8.0.54CVE List
- WSO2 Carbon OAuthaffected: 6.9.6 before 6.9.6.29CVE List
- WSO2 Carbon OAuthaffected: 6.11.21 before 6.11.21.94CVE List
- WSO2 Carbon OAuthaffected: 6.13.16 before 6.13.16.21CVE List
- WSO2 Carbon OAuthaffected: 6.13.19 before 6.13.19.14CVE List
- WSO2 Carbon OAuthaffected: 6.13.27 before 6.13.27.10CVE List
- WSO2 Carbon OAuthaffected: 6.13.41 before 6.13.41.1CVE List
- WSO2 Carbon OAuthaffected: 7.0.26 before 7.0.26.87CVE List
- WSO2 Carbon OAuthaffected: 7.0.259 before 7.0.259.34CVE List
- WSO2 Carbon OAuthaffected: 7.0.385 before 7.0.385.3CVE List