- Yama var
- Son 7 gün
- CWE-613
CVE-2026-3583
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- Yayımlandı
- Güncellendi
- 28 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- WSO2
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.
The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Üreticinin çözüm notu (İngilizce)
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution
Etkilenen sürümler9 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| WSO2 API Control Plane | < 4.5.0 Bilinmiyor | – |
| ≥ 4.5.0, < 4.5.0.68 | 4.5.0.68 | |
| ≥ 4.6.0, < 4.6.0.30 | 4.6.0.30 | |
| ≥ 4.7.0, < 4.7.0.3 | 4.7.0.3 | |
| WSO2 API Manager | < 3.1.0 Bilinmiyor | – |
| ≥ 3.1.0, < 3.1.0.367 | 3.1.0.367 | |
| ≥ 3.2.0, < 3.2.0.475 | 3.2.0.475 | |
| ≥ 3.2.1, < 3.2.1.106 | 3.2.1.106 | |
| ≥ 4.0.0, < 4.0.0.394 | 4.0.0.394 | |
| ≥ 4.1.0, < 4.1.0.267 | 4.1.0.267 | |
| ≥ 4.2.0, < 4.2.0.207 | 4.2.0.207 | |
| ≥ 4.3.0, < 4.3.0.120 | 4.3.0.120 |
ve 44 satır daha
Kaynaklar3 kaynak
Kayıt geçmişi
- Yayımlandı