An authorization code that was issued to a user who has since been deleted is not being invalidated or removed when the user account is deleted. This flaw, classified as CWE‑613 (Improper Authorization), allows an attacker who obtains the orphaned authorization code along with the associated client credentials (client ID and client secret) to redeem the code for an access token on behalf of the now‑deleted user. The attacker could then access any resources or services that were originally granted to that user’s scopes, leading to unauthorized data exposure or service misuse.

The vulnerability affects multiple WSO2 products, including WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon OAuth, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, WSO2 Open Banking IAM, WSO2 Traffic Manager, and WSO2 Universal Gateway. No specific version range is provided in the available data.

The CVSS score of 4.9 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack requires both a valid but orphaned authorization code and the corresponding client credentials, which may be obtained if an attacker has previously compromised the system or obtained credentials through social engineering. Because an attacker does not need to perform a complex exploit but must possess these two artifacts, the likelihood of exploitation remains moderate, especially in environments where credentials are not frequently rotated or revoked.