Token binding validation is enabled in multiple WSO2 products, yet session‑bound tokens are not revoked when a user logs out unless the ‘Revoke token upon user logout’ option is active. This flaw means a malicious actor who has a valid session‑bound token can continue to access applications and sensitive resources even after the original user session has ended, exposing user data and potentially enabling further attacks. The weakness is an authentication bypass caused by improper token lifecycle management (CWE-613).

The vulnerability affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon OAuth, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, WSO2 Open Banking IAM, WSO2 Traffic Manager, and WSO2 Universal Gateway. No specific version information is provided in the advisory.

The CVSS score is 6.5, indicating a moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been documented. The likely attack vector is a malicious actor who acquires a session‑bound token—such as through phishing, credential theft, or token interception—and re‑uses it after the associated user logs out, since the token remains valid until another SSO request triggers revocation. Because the flaw persists even after session termination, an attacker can maintain persistent unauthorized access with the token at hand.