CVE-2025-12624

Katalog CVE

CVSS 5.4 · Medium EPSS 0,18%

Kerentanan Insufficient Session Expiration pada wso2 identity server. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/ advisory vendor