Access Token Vulnerability in WSO2 Identity Server
CVE-2025-0326
Currently unrated
Key Information:
- Vendor
Wso2
- Vendor
- CVE Published:
- 21 October 2026
What is CVE-2025-0326?
The vulnerability arises when WSO2 Identity Server fails to invalidate existing access tokens for sub-organization users during sensitive operations such as password resets, role changes, or sub-organization disablement. This oversight allows active tokens to remain valid even after administrative modifications to the user's access, increasing the risk of unauthorized access if these tokens fall into the wrong hands.
Affected Version(s)
WSO2 Carbon OAuth 7.0.26 < 7.0.26.51
WSO2 Identity Server 7.0.0 < 7.0.0.85
WSO2 Carbon OAuth x