OAuth2 Token Introspection Flaw in WSO2 Product

CVE-2026-3583

What is CVE-2026-3583?

An issue exists within the OAuth2 token introspection mechanism of WSO2 products when the 'allowed_scopes' configuration is enabled. Specifically, the system fails to immediately invalidate a token in the cache following a revocation request. This leads to a risk where an access token, which was checked immediately before revocation, can still be erroneously issued to the client until the cache is refreshed. As a result, while the revoked token isn't acknowledged as valid for API authorization, users may face challenges in obtaining new valid access tokens during the cache's lifetime, potentially causing interruptions in their authentication processes.

References