org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth vulnerabilities

CVEs whose affected-version data names the org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-13173Medium· 6.5

today

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation an…

▾ SunlitWSO2 · WSO2 API Control Planevia CVEORG