Skip to content
Fencer Intel
low 2.4

CVE-2025-12627 json

Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

published 3mo ago modified last mo. also EUVD-2025-210629

cvss
2.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.

An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.

Patch / fix

  • WSO2 WSO2 Identity Server 7.0.0.130, 7.1.0.38
  • WSO2 WSO2 Carbon OAuth 7.0.26.83, 7.0.259.31

Is CVE-2025-12627 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 2.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Affected products

  • WSO2 WSO2 Identity Server
  • WSO2 WSO2 Carbon OAuth

Classification

Weakness
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.