CVE-2025-12627

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12627", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-11-03T08:28:21.947Z", "datePublished": "2026-08-06T07:33:12.382Z", "dateUpdated": "2026-08-06T12:33:46.393Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-08-06T07:33:12.382Z"}, "title": "Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-10", "descriptions": [{"lang": "en", "value": "CAPEC-10 CAPEC-10: Token Impersonation"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.130", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.38", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon OAuth", "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth", "versions": [{"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.83", "versionType": "custom"}, {"status": "affected", "version": "7.0.259", "lessThan": "7.0.259.31", "versionType": "custom"}, {"status": "unaffected", "version": "x", "lessThanOrEqual": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.0.130"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.1.0.38"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.26", "versionEndExcluding": "7.0.26.83"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.259", "versionEndExcluding": "7.0.259.31"}, {"vulnerable": false, "criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "x", "versionEndIncluding": "*"}]}]}], "descriptions": [{"lang": "en", "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2025-4619", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T12:33:32.172062Z", "id": "CVE-2025-12627", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T12:33:46.393Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:33:32.172062Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T12:33:43.358Z"}}], "cna": {"title": "Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions", "source": {"advisory": "WSO2-2025-4619", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-10", "descriptions": [{"lang": "en", "value": "CAPEC-10 CAPEC-10: Token Impersonation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.130", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.38", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon OAuth", "versions": [{"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.83", "versionType": "custom"}, {"status": "affected", "version": "7.0.259", "lessThan": "7.0.259.31", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.", "supportingMedia": [{"type": "text/html", "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.0.130", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.0.38", "versionStartIncluding": "7.1.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.26.83", "versionStartIncluding": "7.0.26"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.259.31", "versionStartIncluding": "7.0.259"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*", "vulnerable": false, "versionEndIncluding": "*", "versionStartIncluding": "x"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-08-06T07:33:12.382Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12627", "state": "PUBLISHED", "dateUpdated": "2026-08-06T12:33:46.393Z", "dateReserved": "2025-11-03T08:28:21.947Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-08-06T07:33:12.382Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "7.0.0.130", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "7.1.0.38", "status": "affected", "version": "7.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth", "product": "WSO2 Carbon OAuth", "vendor": "WSO2", "versions": [{"lessThan": "7.0.26.83", "status": "affected", "version": "7.0.26", "versionType": "custom"}, {"lessThan": "7.0.259.31", "status": "affected", "version": "7.0.259", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "x", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D06E76F-D338-474A-A04E-71D9440E48E6", "versionEndExcluding": "7.0.0.130", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A73495D-37B9-498F-8FB5-4A0B6E121B76", "versionEndExcluding": "7.1.0.38", "versionStartIncluding": "7.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.\n\nAn attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor."}, {"lang": "es", "value": "El flujo de suplantaci\u00f3n de identidad de usuario en WSO2 Identity Server no gestiona adecuadamente los tokens de actualizaci\u00f3n asociados con sesiones suplantadas. Esto permite a un atacante que ha obtenido un token de acceso para un usuario suplantado aprovechar la concesi\u00f3n de token de actualizaci\u00f3n para obtener nuevos tokens de acceso, extendiendo su capacidad para actuar como el usuario leg\u00edtimo.\n\nUn atacante que obtiene acceso al token de acceso de un usuario suplantado puede explotar esta debilidad para renovar su autorizaci\u00f3n. Esto resulta en la capacidad continua de realizar acciones en nombre del usuario real, comprometiendo la integridad y trazabilidad del registro al enmascarar al verdadero actor."}], "id": "CVE-2025-12627", "lastModified": "2026-09-29T14:10:00.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12627", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T12:33:32.172062Z", "version": "2.0.3"}}]}, "published": "2026-08-06T08:16:28.063", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "tags": ["Vendor Advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.0,7.0.0.130)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.1.0,7.1.0.38)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "identity_server", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.26,7.0.26.83)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.259,7.0.259.31)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[x,*)"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 87.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon OAuth", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_oauth", "vendor": "wso2"}], "created": "2026-08-06T09:30:02.867913+00:00", "updated": "2026-08-07T09:15:07.108300+00:00", "vendors": ["wso2", "wso2$PRODUCT$identity_server", "wso2$PRODUCT$wso2_carbon_oauth"]}