CVE-2025-1397 PUBLISHED

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

Assigner: WSO2
Reserved: 17.02.2025 Published: 03.11.2026 Updated: 03.11.2026

When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.

A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 4.8

Product Status

Vendor WSO2
Product WSO2 Universal Gateway
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.10 (excl.)
Vendor WSO2
Product WSO2 Traffic Manager
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.10 (excl.)
Vendor WSO2
Product WSO2 API Manager
Versions Default: unaffected
  • unknown from 0 to 3.1.0 (excl.)
  • affected from 3.1.0 to 3.1.0.321 (excl.)
  • affected from 3.2.0 to 3.2.0.414 (excl.)
  • affected from 3.2.1 to 3.2.1.50 (excl.)
  • affected from 4.0.0 to 4.0.0.335 (excl.)
  • affected from 4.1.0 to 4.1.0.211 (excl.)
  • affected from 4.2.0 to 4.2.0.150 (excl.)
  • affected from 4.3.0 to 4.3.0.63 (excl.)
  • affected from 4.4.0 to 4.4.0.26 (excl.)
  • affected from 4.5.0 to 4.5.0.10 (excl.)
Vendor WSO2
Product WSO2 API Control Plane
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.11 (excl.)
Vendor WSO2
Product WSO2 Identity Server
Versions Default: unaffected
  • unknown from 0 to 5.10.0 (excl.)
  • affected from 5.10.0 to 5.10.0.346 (excl.)
  • affected from 5.11.0 to 5.11.0.396 (excl.)
  • affected from 6.0.0 to 6.0.0.232 (excl.)
  • affected from 6.1.0 to 6.1.0.224 (excl.)
  • affected from 7.0.0 to 7.0.0.93 (excl.)
Vendor WSO2
Product WSO2 Open Banking AM
Versions Default: unaffected
  • unknown from 0 to 2.0.0 (excl.)
  • affected from 2.0.0 to 2.0.0.370 (excl.)
Vendor WSO2
Product WSO2 Open Banking IAM
Versions Default: unaffected
  • unknown from 0 to 2.0.0 (excl.)
  • affected from 2.0.0 to 2.0.0.390 (excl.)
Vendor WSO2
Product WSO2 Identity Server as Key Manager
Versions Default: unaffected
  • unknown from 0 to 5.10.0 (excl.)
  • affected from 5.10.0 to 5.10.0.339 (excl.)
Vendor WSO2
Product WSO2 Carbon OAuth
Versions Default: unknown
  • affected from 6.4.2 to 6.4.2.155 (excl.)
  • affected from 6.4.111 to 6.4.111.134 (excl.)
  • affected from 6.4.176 to 6.4.176.25 (excl.)
  • affected from 6.4.180 to 6.4.180.11 (excl.)
  • affected from 6.8.0 to 6.8.0.49 (excl.)
  • affected from 6.9.6 to 6.9.6.22 (excl.)
  • affected from 6.11.21 to 6.11.21.75 (excl.)
  • affected from 6.13.16 to 6.13.16.15 (excl.)
  • affected from 6.13.19 to 6.13.19.9 (excl.)
  • affected from 6.13.27 to 6.13.27.2 (excl.)
  • affected from 7.0.26 to 7.0.26.58 (excl.)
Vendor WSO2
Product JWT Grant Type For OAuth2
Versions Default: unknown
  • affected from 1.0.26 to 1.0.26.6 (excl.)
  • affected from 1.0.26 to 1.0.26.7 (excl.)
  • affected from 1.0.31 to 1.0.31.3 (excl.)
  • affected from 1.1.0 to 1.1.0.2 (excl.)
  • affected from 2.0.4 to 2.0.4.3 (excl.)
  • affected from 2.1.1 to 2.1.1.2 (excl.)
  • affected from 2.2.0 to 2.2.0.3 (excl.)
  • affected from 2.2.4 to 2.2.4.1 (excl.)
  • affected from 2.3.1 to 2.3.1.4 (excl.)

Solutions

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution

References

Problem Types

  • CWE-862: Missing Authentication for Critical Function CWE

Impacts

  • CAPEC-346 CAPEC-346: Token Generation/Distribution Abuse