CVE-2025-12624 — MEDIUM (6.0)

Vulnerability Description

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.

CVSS Score

6.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Wso2	Identity Server	5.2.0

Related Weaknesses (CWE)

CWE-613

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisorVendor Advisory

FAQ

What is CVE-2025-12624?

CVE-2025-12624 is a vulnerability with a CVSS score of 6.0 (MEDIUM). Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usabl...

How severe is CVE-2025-12624?

CVE-2025-12624 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-12624?

Check the references section above for vendor advisories and patch information. Affected products include: Wso2 Identity Server.