Token Revocation Flaw in WSO2 Identity Server with Case-Sensitive Database
CVE-2026-6647

7.4HIGH

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server
Wso2 Carbon Oauth
Vendor
CVE Published:
28 October 2026

What is CVE-2026-6647?

In certain installations of WSO2 Identity Server where the user store is configured to be case-insensitive while the underlying database is case-sensitive, a vulnerability arises. This discrepancy leads to issues in the handling of usernames, particularly those with mixed-case characters during OAuth token revocation processes. As a result, operations intended to invalidate access or refresh tokens may fail, allowing an adversary with a valid token linked to a mixed-case username to exploit this flaw. The failure to revoke these tokens can enable unauthorized actions to continue, undermining the server's access controls and security protocols.

Affected Version(s)

WSO2 Carbon OAuth 7.0.385 < 7.0.385.17

WSO2 Identity Server 7.2.0 < 7.2.0.21

WSO2 Carbon OAuth 7.5.23

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.