The flaw prevents WSO2 Identity Server from invalidating existing access tokens for users in sub‑organizations during critical account management operations such as password reset, role changes, or sub‑organization disablement. Because tokens continue to be accepted after the user’s access context is modified or revoked, a malicious actor who has obtained one of these tokens can use it to gain unauthorized access to protected resources. The issue is classified as CWE‑613, a sensitive token exposure weakness.

The vulnerability affects WSO2 Carbon OAuth and WSO2 Identity Server products. Specific version information is not provided in the advisory.

The CVSS score of 7.4 and EPSS score of < 1% indicate a high severity and low but nonzero exploitation probability. The vulnerability is catalogued as not in CISA KEV. Exploitation requires that a previously issued token remains active and that the token has been exposed to a malicious actor. Based on the description, the likely attack vector would involve a compromised token being used to authenticate against the system. The risk is significant for any environment where such tokens can be leaked or intercepted, while the likelihood of exploitation remains uncertain due to the lack of publicly available exploitation data.