WC
Product
WSO2 Carbon OAuth
6
CVEs
0
On KEV
7.4
Max CVSS
4
New 30D
Severity mix
Critical 0High 1Medium 2Low 2
Watch
Add WSO2 Carbon OAuth to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6647 New | 7.4 | Oct 28 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events Affected: 7.0.385 before 7.0.385.17 |
| CVE-2025-13173 | 6.5 | Oct 19 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination Affected: 6.4.2 before 6.4.2.171; 6.4.111 before 6.4.111.165; 6.4.176 before 6.4.176.30; 6.4.180 before 6.4.180.14; 6.8.0 before 6.8.0.54; 6.9.6 before 6.9.6.29; +8 more |
| CVE-2024-8995 | 4.9 | Aug 6 | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access Affected: 6.4.2 before 6.4.2.154; 6.4.111 before 6.4.111.131; 6.4.176 before 6.4.176.35; 6.4.180 before 6.4.180.17; 6.8.0 before 6.8.0.46; 6.9.6 before 6.9.6.34; +5 more |
| CVE-2026-3583 New | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] Affected: 6.4.2 before 6.4.2.178; 6.4.111 before 6.4.111.174; 6.4.176 before 6.4.176.38; 6.4.180 before 6.4.180.25; 6.8.0 before 6.8.0.59; 6.9.6 before 6.9.6.36; +10 more |
| CVE-2025-12627 | 2.4 | Aug 6 | Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions Affected: 7.0.26 before 7.0.26.83; 7.0.259 before 7.0.259.31 |
| CVE-2025-0326 | – | Oct 21 | Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access Affected: 7.0.26 before 7.0.26.51 |
Showing 6