Skip to content
OpenAdvisories

Product · WSO2

WSO2 API Control Plane

51 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-3583

    Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

    When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately be…

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Identity Server as Key Manager