Advisories · Technology
WSO2 Carbon OAuth.
Every CVE that names WSO2 Carbon OAuth among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.8 Medium
Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
- WSO2 Universal Gateway
- WSO2 Traffic Manager
- Broken access control
- CVSS 4.9 Medium
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
- WSO2 API Manager
- WSO2 Universal Gateway
- Authentication bypass
- CVSS 7.4 High
Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
- WSO2 Identity Server
- WSO2 Carbon OAuth
- Authentication bypass
- CVSS 3.1 Low
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- WSO2 API Manager
- WSO2 Traffic Manager
- Authentication bypass
- CVSS 7.4 High
Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
- WSO2 Identity Server
- WSO2 Carbon OAuth
- Authentication bypass
- CVSS 6.5 Medium
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
- WSO2 API Control Plane
- WSO2 Universal Gateway
- Authentication bypass
- CVSS 2.4 Low
Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
- WSO2 Identity Server
- WSO2 Carbon OAuth
- Authentication bypass
- CVSS 4.9 Medium
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
- WSO2 API Manager
- WSO2 Traffic Manager
- Authentication bypass