Active access tokens are not revoked when a user account is locked in WSO2 Identity Server. This flaw allows previously issued, unexpired tokens to remain valid after the account is locked, creating a security gap where the locked account can continue to access protected resources. The vulnerability results in unauthorized access and a breach of access‑control policies until the tokens naturally expire, as defined by CWE‑613.

The flaw affects WSO2 Identity Server. No specific version range is listed in the advisory, so all versions of the product are potentially vulnerable until a patch is applied.

The CVSS score is 6, indicating a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack path is inferred to rely on an account that already holds a valid token; after the account is locked, an attacker can continue to use that token until it expires. The issue is exploitable in any environment where users or administrators can lock accounts and there is no automatic token revocation policy in place.