CVE-2024-8995
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Unused authorization codes issued to deleted users are not properly invalidated or removed, allowing potential reuse. An attacker with the code and client credentials can obtain access tokens on behalf of deleted users, leading to unauthorized access.
Risk Assessment
Risk of unauthorized access to sensitive resources if an attacker obtains authorization codes and client credentials. This could compromise data integrity and confidentiality.
Recommendation
Immediately invalidate and remove authorization codes upon user deletion and regularly review token invalidation mechanisms.
Other vulnerabilities in WSO2 Identity Server
See all- CVE-2016-4312High
The XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause denial of service, conduct SSRF attacks, or have unspecified other impacts via a crafted XACML request.
- CVE-2016-4311High
CVE-2016-4311 is a CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 that allows remote attackers to hijack the authentication of privileged users for requests processing XACML requests.
- CVE-2025-14779Low
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation can result in unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and denial-of-service.
- CVE-2025-13736Low
When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage.
- CVE-2025-12627Low
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization, resulting in continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability.
- CVE-2024-6832Medium
The account locking mechanism fails when secondary user stores are inaccessible, allowing repeated authentication attempts without lockout. This leaves users in accessible stores vulnerable to brute force attacks.
- CVE-2024-10302Medium
The user self-signup flow in multiple WSO2 products fails to validate user-supplied input, allowing unvalidated data into user claims used by downstream processes. This can lead to various attacks like content manipulation, redirection, and data exposure.
Original NVD description (English source)
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.