Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock

The primary impact of CVE-2025-12624 is the circumvention of access control policies. A locked user account can continue to access protected resources using existing, unexpired access tokens. This bypasses the intended security measure of account locking, potentially leading to unauthorized data access, modification, or deletion. The blast radius is dependent on the permissions associated with the access tokens and the sensitivity of the resources they grant access to. This vulnerability could be exploited to gain persistent access to sensitive data even after an account has been compromised or disabled.

Organizations heavily reliant on WSO2 Identity Server for authentication and authorization are at risk. This includes those with legacy configurations or deployments where access tokens have long expiration times. Shared hosting environments utilizing WSO2 Identity Server are also particularly vulnerable, as compromised accounts on one instance could potentially impact other tenants.

• java / server:

# Check for WSO2 Identity Server version
java -version
# Monitor logs for unusual access token activity related to locked accounts
grep -i 'access token' /path/to/wso2/identity-server/logs/*.log

• generic web:

# Check for exposed token endpoints
curl -I https://your-wso2-identity-server/token

1. 2026-04-16Disclosure

   disclosure

1. Reserviert2025-11-03
2. Veröffentlicht2026-04-16
3. EPSS aktualisiert2026-04-23

The recommended mitigation for CVE-2025-12624 is to upgrade WSO2 Identity Server to version 5.2.0.35 or later. As an interim workaround, consider implementing token expiration policies with shorter durations to minimize the window of opportunity for exploitation. Review and strengthen access control policies to limit the potential impact of compromised tokens. Monitor audit logs for any suspicious activity related to locked user accounts and access token usage. After upgrading, verify the fix by locking a user account and attempting to access protected resources using a previously issued access token; the access should be denied.