Session Management Flaw in WSO2 Identity Server
CVE-2025-13173

6.5MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Control Plane
Wso2 Universal Gateway
Wso2 Api Manager
Wso2 Traffic Manager
Vendor
CVE Published:
19 October 2026

What is CVE-2025-13173?

A session management flaw exists in WSO2 Identity Server where session-bound tokens are not revoked upon user session termination. This vulnerability arises when token binding validation is active but the 'Revoke token upon user logout' option is not selected. Consequently, a malicious entity could potentially leverage a valid session-bound token to gain unauthorized access, thus compromising sensitive user information even after the user has logged out.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.47

WSO2 API Control Plane 4.6.0 < 4.6.0.13

WSO2 API Manager 3.1.0 < 3.1.0.352

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.