CVE-2025-12317

Published: Ago 07, 2026 Last Modified: Ago 07, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,0
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low

Description

AI Translation Available

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.

This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.

613

Insufficient Session Expiration

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
https://security.docs.wso2.com/en/latest/security-announcem…
https://security.docs.wso2.com/en/latest/security-announcements/security-adviso…