Token Re-Validation Flaw in WSO2 Products

CVE-2024-9517

What is CVE-2024-9517?

A vulnerability exists in WSO2 products where the refresh token grant type does not properly re-validate the account status before issuing new access tokens. This flaw allows attackers to obtain valid access tokens even after user accounts have been blocked, effectively bypassing account lockout mechanisms. Exploiting this vulnerability provides attackers with unauthorized access to user accounts and their resources, enabling potential privilege escalation and data exfiltration based on the permissions associated with the compromised accounts.

References