CVE-2025-0326: 
WSO2 Identity Server vulnerability analysis and mitigation

CVE-2025-0326 is an Insufficient Session Expiration vulnerability in WSO2 Identity Server that allows previously issued access tokens to remain active after sensitive administrative operations such as password resets, role changes, or sub-organization disablement. It affects WSO2 Identity Server versions 7.0.0 through 7.0.0.84 (fixed in 7.0.0.85) and the org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth component versions 7.0.26 through 7.0.26.50 (fixed in 7.0.26.51). The vulnerability was disclosed on October 21, 2026, and is classified as CWE-613. The CVSS base score is reported as 0.0 (pending full analysis), with an estimated Medium severity (GitHub Advisory, WSO2 Advisory).

The root cause is CWE-613 (Insufficient Session Expiration): the WSO2 Identity Server OAuth2 component does not invalidate existing access tokens for sub-organization users when administrative actions — specifically password reset, role change, or sub-organization disablement — are performed. This means the token lifecycle is decoupled from the user's authorization context, so a token issued before an administrative change continues to grant access as if the change never occurred. Exploitation requires that an attacker has already obtained a valid access token (e.g., through prior interception, leakage, or theft) and that the token has not yet naturally expired (GitHub Advisory, WSO2 Advisory).

Successful exploitation allows an attacker who has obtained a previously issued access token to maintain unauthorized access to sub-organization user accounts even after administrators have taken remediation actions such as resetting passwords, changing roles, or disabling the sub-organization. This effectively nullifies administrative revocation efforts, potentially enabling persistent unauthorized access to resources and data accessible to the compromised account. The impact is conditional on token exposure and is scoped to sub-organization users within WSO2 Identity Server deployments (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is conditional: an attacker must have already obtained a valid, unexpired access token through a separate means (e.g., token leakage or interception) before the administrative action was taken (GitHub Advisory).

1. Token Acquisition: Obtain a valid access token for a sub-organization user through a prior attack vector such as phishing, man-in-the-middle interception, credential theft, or exploitation of another vulnerability that exposes tokens.
2. Trigger Administrative Action: Wait for or induce an administrator to perform a sensitive account management operation on the target user — such as a password reset, role change, or sub-organization disablement — which would normally be expected to revoke access.
3. Verify Token Persistence: Attempt to use the previously obtained access token against WSO2 Identity Server API endpoints to confirm it remains valid despite the administrative action.
4. Maintain Unauthorized Access: Continue using the still-active token to access resources, APIs, or data within the sub-organization that the user's account had access to, bypassing the intended revocation (GitHub Advisory, WSO2 Advisory).

• Logs: Access token usage in WSO2 Identity Server audit logs for sub-organization users whose accounts have been recently modified (password reset, role change, or sub-organization disabled) — particularly API calls occurring after the administrative action timestamp.
• Network: Authenticated API requests to WSO2 Identity Server endpoints using tokens belonging to accounts that have been administratively modified or disabled.
• Behavioral: Successful authorization events for users whose sub-organizations have been disabled or whose roles have been downgraded, indicating token reuse post-revocation.

WSO2 has released fixes in WSO2 Identity Server version 7.0.0.85 and org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth version 7.0.26.51. Organizations should upgrade to these patched versions as the primary remediation. As interim workarounds, administrators should implement shorter token expiration lifetimes to reduce the window of exposure, manually review and revoke active tokens for users whose access context has changed, and monitor audit logs for suspicious token usage following administrative account modifications (WSO2 Advisory, GitHub Advisory).