Skip to contentWso2 Carbon Oauth vulnerabilities
- wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 moreImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity ProvidersCVE-2025-13974.8 Medium
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsCVE-2024-95174.9 Medium
- wso2 identity server, carbon oauth +1 moreIncomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsCVE-2026-66477.4 High
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]CVE-2026-35833.1 Low
- wso2 identity server, carbon oauth +1 moreImproper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessCVE-2025-03267.4 High
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationCVE-2025-131736.5 Medium
- wso2 identity server, carbon oauth +1 moreImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsCVE-2025-126272.4 Low
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium