Authentication Token Vulnerability in WSO2 Platform

CVE-2025-12317

What is CVE-2025-12317?

This vulnerability presents a significant issue within WSO2 Identity Server, where the removal of internal user roles does not trigger the invalidation of existing authentication tokens linked to that user. Consequently, users can maintain their unauthorized access rights and perform actions that should be restricted, as their authentication tokens remain valid until they naturally expire. This flaw underscores the importance of effective role management and security mechanisms to prevent unauthorized access to sensitive resources.

References