CVE-2025-12624

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12624", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-11-03T06:20:27.950Z", "datePublished": "2026-04-16T10:25:19.789Z", "dateUpdated": "2026-04-16T12:30:14.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-04-16T10:25:19.789Z"}, "title": "Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-149", "descriptions": [{"lang": "en", "value": "CAPEC-149 CAPEC-149: Session Token Handling"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.2.0", "versionType": "custom"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.0.35", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2.0", "versionEndExcluding": "5.2.0.35"}]}]}], "descriptions": [{"lang": "en", "value": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2025-4684", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T12:19:51.834842Z", "id": "CVE-2025-12624", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:30:14.886Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12624", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T12:19:51.834842Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:19:52.974Z"}}], "cna": {"title": "Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock", "source": {"advisory": "WSO2-2025-4684", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-149", "descriptions": [{"lang": "en", "value": "CAPEC-149 CAPEC-149: Session Token Handling"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.2.0", "versionType": "custom"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.0.35", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.", "supportingMedia": [{"type": "text/html", "value": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.2.0.35", "versionStartIncluding": "5.2.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-04-16T10:25:19.789Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12624", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:30:14.886Z", "dateReserved": "2025-11-03T06:20:27.950Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-04-16T10:25:19.789Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.2.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.2.0.35", "status": "affected", "version": "5.2.0", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "2689AF3E-01AA-4B79-BA55-6BB3D81E16CF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.\n\nThe security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire."}, {"lang": "es", "value": "Los tokens de acceso activos no son revocados o invalidados cuando una cuenta de usuario es bloqueada dentro de WSO2 Identity Server. Esta falla en aplicar la revocaci\u00f3n permite que los tokens v\u00e1lidos, emitidos previamente, permanezcan utilizables, posibilitando el acceso continuo a recursos protegidos por cuentas de usuario bloqueadas.\n\nLa consecuencia de seguridad es que una cuenta de usuario bloqueada puede mantener el acceso a recursos protegidos mediante el uso de tokens de acceso existentes y no caducados. Esto crea una brecha de seguridad donde las pol\u00edticas de control de acceso son eludidas, lo que podr\u00eda llevar a un acceso no autorizado a datos o acciones hasta que los tokens caduquen de forma natural."}], "id": "CVE-2025-12624", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.7, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12624", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T12:19:51.834842Z", "version": "2.0.3"}}]}, "published": "2026-04-16T11:16:26.447", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "tags": ["Vendor Advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.2.0,5.2.0.35)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "identity_server", "vendor": "wso2"}], "analysis": {"en": {"generated_at": "2026-04-17T03:26:08.968151+00:00", "value": {"mitigation_remediation": ["Follow the vendor\u2011advised procedure at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4684/#solution to apply the latest patch or configuration changes that enforce token revocation on account lock.", "Verify token revocation by locking a test account and attempting to use an active token associated with that account; the request should be denied.", "Review existing tokens in the identity server, identify any tokens belonging to locked accounts, and revoke them manually or via a cleanup script."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access via Persistent Tokens"}, "threat_synthesis": {"affected_systems": "The flaw affects WSO2 Identity Server. No specific version range is listed in the advisory, so all versions of the product are potentially vulnerable until a patch is applied.", "description_and_impact": "Active access tokens are not revoked when a user account is locked in WSO2 Identity Server. This flaw allows previously issued, unexpired tokens to remain valid after the account is locked, creating a security gap where the locked account can continue to access protected resources. The vulnerability results in unauthorized access and a breach of access\u2011control policies until the tokens naturally expire, as defined by CWE\u2011613.", "risk_and_exploitability": "The CVSS score is 6, indicating a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack path is inferred to rely on an account that already holds a valid token; after the account is locked, an attacker can continue to use that token until it expires. The issue is exploitable in any environment where users or administrators can lock accounts and there is no automatic token revocation policy in place."}}}}, "created": "2026-04-16T12:30:05.966934+00:00", "updated": "2026-04-17T03:30:08.596584+00:00", "vendors": ["wso2", "wso2$PRODUCT$identity_server"]}