CVE-2024-9517Medium· 4.9▾ SunlitThe refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.
This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
api_manager >= 3.1.0 < 3.1.0.308api_manager >= 3.2.0 < 3.2.0.429api_manager >= 3.2.1 < 3.2.1.49api_manager >= 4.0.0 < 4.0.0.315api_manager >= 4.1.0 < 4.1.0.214api_manager >= 4.2.0 < 4.2.0.149api_manager >= 4.3.0 < 4.3.0.62api_manager >= 4.4.0 < 4.4.0.25api_manager >= 4.5.0 < 4.5.0.9universal_gateway >= 4.5.0 < 4.5.0.9traffic_manager >= 4.5.0 < 4.5.0.9api_control_plane >= 4.5.0 < 4.5.0.10identity_server_as_key_manager >= 5.10.0 < 5.10.0.324identity_server >= 5.10.0 < 5.10.0.331identity_server >= 5.11.0 < 5.11.0.376identity_server >= 6.0.0 < 6.0.0.219identity_server >= 6.1.0 < 6.1.0.205identity_server >= 7.0.0 < 7.0.0.73open_banking_am >= 2.0.0 < 2.0.0.357open_banking_iam >= 2.0.0 < 2.0.0.377org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.2 < 6.4.2.148org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.111 < 6.4.111.122org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.176 < 6.4.176.26org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.180 < 6.4.180.10org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.8.0 < 6.8.0.44org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.9.6 < 6.9.6.21org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.11.21 < 6.11.21.64org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.13.16 < 6.13.16.13org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.13.19 < 6.13.19.7org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.13.27 < 6.13.27.1org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 7.0.26 < 7.0.26.37Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-3583Low· 3.1Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVE-2026-0637Medium· 5.4Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2026-4052Critical· 9.8Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVE-2024-5617Medium· 4.8Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2025-11969Critical· 9.4Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
CVE-2024-12139Medium· 4.3Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks