WSO2 Identity Server Access Token Revocation Vulnerability in Locked Accounts

A vulnerability exists in WSO2 Identity Server version 5.2.0, where active access tokens are not revoked when a user account is locked. This oversight allows locked accounts to continue accessing protected resources using unexpired tokens, bypassing access control measures and potentially leading to unauthorized data access or actions.

Impact

Locked user accounts can maintain access to protected resources through existing, valid access tokens, creating a security gap that bypasses access control policies.

Remediation

Community users should migrate to the latest unaffected version of WSO2 Identity Server. Support subscription holders can update to version 5.2.0, update level 35, to address this vulnerability.