Skip to content
Fencer Intel
low 3.1

CVE-2026-3583 json

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

published 12d ago modified 11d ago also EUVD-2026-112400

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.

The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Patch / fix

  • WSO2 WSO2 API Manager 3.1.0.367, 3.2.0.475, 3.2.1.106, 4.0.0.394, 4.1.0.267, 4.2.0.207, 4.3.0.120, 4.4.0.83, 4.5.0.67, 4.6.0.29, 4.7.0.3
  • WSO2 WSO2 Traffic Manager 4.5.0.65, 4.6.0.29, 4.7.0.3
  • WSO2 WSO2 Universal Gateway 4.5.0.67, 4.6.0.29, 4.7.0.3
  • WSO2 WSO2 API Control Plane 4.5.0.68, 4.6.0.30, 4.7.0.3
  • WSO2 WSO2 Identity Server 5.10.0.397, 5.11.0.444, 6.0.0.270, 6.1.0.269, 7.0.0.152, 7.1.0.61, 7.2.0.20, 7.3.0.1
  • WSO2 WSO2 Open Banking IAM 2.0.0.434
  • WSO2 WSO2 Identity Server as Key Manager 5.10.0.387
  • WSO2 WSO2 Open Banking AM 2.0.0.414
  • WSO2 WSO2 Carbon OAuth 6.4.2.178, 6.4.111.174, 6.4.176.38, 6.4.180.25, 6.8.0.59, 6.9.6.36, 6.11.21.118, 6.13.16.32, 6.13.19.23, 6.13.27.21, 6.13.41.9, 6.14.14.3, 7.0.26.103, 7.0.259.54, 7.0.385.15, 7.4.99.5, 7.5.78

Is CVE-2026-3583 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11d ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Traffic Manager
  • WSO2 WSO2 Universal Gateway
  • WSO2 WSO2 API Control Plane
  • WSO2 WSO2 Identity Server
  • WSO2 WSO2 Open Banking IAM
  • WSO2 WSO2 Identity Server as Key Manager
  • WSO2 WSO2 Open Banking AM
  • WSO2 WSO2 Carbon OAuth

Classification

Weakness
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.