CVE-2025-12627
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization, resulting in continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability.
Risk Assessment
The risk includes unauthorized access to user accounts and the ability to impersonate them for extended periods, potentially leading to data confidentiality breaches and system integrity issues.
Recommendation
It is recommended to immediately upgrade WSO2 Identity Server to a patched version and implement mechanisms to monitor and expire refresh tokens for impersonated sessions.
Original NVD description (English source)
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.