The refresh token grant type in several WSO2 products fails to re‑validate an account’s status before issuing new access tokens. Because blocked accounts are still granted tokens, an attacker can obtain valid credentials even after an account has been disabled, leading to unauthorized actions in place of the blocked user. This flaw may enable privilege escalation or data exfiltration depending on the permissions of the compromised account.

The vulnerability affects WSO2 API Control Plane, API Manager, Carbon OAuth, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager, and Universal Gateway. No specific version information is supplied, so all releases are potentially impacted until a patch is applied.

With a CVSS score of 4.9 the vulnerability is considered moderate, and the EPSS score is unavailable, suggesting limited but non‑negligible exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the weakness by sending a refresh token request through the OAuth flow; any holder of a valid refresh token for a blocked account can obtain a new access token, bypassing lockout controls.