CVE-2025-12627Low· 2.4▾ SunlitThe user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.
An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.
identity_server >= 7.0.0, < 7.0.0.130identity_server >= 7.1.0, < 7.1.0.38Upgrade past the affected range:
identity_server 7.1.0.38Connected by shared product, vendor, weakness, or advisory.
CVE-2025-12624Medium· 6.0Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server
CVE-2025-0326NoneImproper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
CVE-2025-13173Medium· 6.5Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
CVE-2025-10470High· 8.6The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service co…
CVE-2025-9973Medium· 6.4Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations
CVE-2025-10908High· 7.3Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods