All vulnerabilities
CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

WSO2 WSO2 API Manager
Open in ThreatlineRecord JSON
CVSS
3.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.1.0.367Also 3.2.0.475, 3.2.1.106 and 38 moreCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

Show all 47 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.

The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Text from CVE List

Affected versions 56

  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.367CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.475CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.106CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.394CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.267CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.207CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.120CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.83CVE List
  • WSO2 API Manageraffected: 4.5.0 before 4.5.0.67CVE List
  • WSO2 API Manageraffected: 4.6.0 before 4.6.0.29CVE List
  • WSO2 API Manageraffected: 4.7.0 before 4.7.0.3CVE List
  • WSO2 Traffic Managerunknown: all versions before 4.5.0CVE List
  • WSO2 Traffic Manageraffected: 4.5.0 before 4.5.0.65CVE List
  • WSO2 Traffic Manageraffected: 4.6.0 before 4.6.0.29CVE List
  • WSO2 Traffic Manageraffected: 4.7.0 before 4.7.0.3CVE List
  • WSO2 Universal Gatewayunknown: all versions before 4.5.0CVE List
  • WSO2 Universal Gatewayaffected: 4.5.0 before 4.5.0.67CVE List
  • WSO2 Universal Gatewayaffected: 4.6.0 before 4.6.0.29CVE List
  • WSO2 Universal Gatewayaffected: 4.7.0 before 4.7.0.3CVE List
  • WSO2 API Control Planeunknown: all versions before 4.5.0CVE List
  • WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.68CVE List
  • WSO2 API Control Planeaffected: 4.6.0 before 4.6.0.30CVE List
  • WSO2 API Control Planeaffected: 4.7.0 before 4.7.0.3CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.397CVE List
  • WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.444CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.270CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.269CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.152CVE List
  • WSO2 Identity Serveraffected: 7.1.0 before 7.1.0.61CVE List
  • WSO2 Identity Serveraffected: 7.2.0 before 7.2.0.20CVE List
  • WSO2 Identity Serveraffected: 7.3.0 before 7.3.0.1CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.434CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.387CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.414CVE List
  • WSO2 Carbon OAuthaffected: 6.4.2 before 6.4.2.178CVE List
  • WSO2 Carbon OAuthaffected: 6.4.111 before 6.4.111.174CVE List
  • WSO2 Carbon OAuthaffected: 6.4.176 before 6.4.176.38CVE List
  • WSO2 Carbon OAuthaffected: 6.4.180 before 6.4.180.25CVE List
  • WSO2 Carbon OAuthaffected: 6.8.0 before 6.8.0.59CVE List
  • WSO2 Carbon OAuthaffected: 6.9.6 before 6.9.6.36CVE List
  • WSO2 Carbon OAuthaffected: 6.11.21 before 6.11.21.118CVE List
  • WSO2 Carbon OAuthaffected: 6.13.16 before 6.13.16.32CVE List
  • WSO2 Carbon OAuthaffected: 6.13.19 before 6.13.19.23CVE List
  • WSO2 Carbon OAuthaffected: 6.13.27 before 6.13.27.21CVE List
  • WSO2 Carbon OAuthaffected: 6.13.41 before 6.13.41.9CVE List
  • WSO2 Carbon OAuthaffected: 6.14.14 before 6.14.14.3CVE List
  • WSO2 Carbon OAuthaffected: 7.0.26 before 7.0.26.103CVE List
  • WSO2 Carbon OAuthaffected: 7.0.259 before 7.0.259.54CVE List
  • WSO2 Carbon OAuthaffected: 7.0.385 before 7.0.385.15CVE List
  • WSO2 Carbon OAuthaffected: 7.4.99 before 7.4.99.5CVE List
  • WSO2 Carbon OAuthunaffected: 7.5.78CVE List

References 1