This vulnerability allows an attacker to obtain access tokens by using JWT or SAML2 bearer grants targeting an identity provider that has been disabled. The system does not verify the provider’s status before issuing a token, effectively bypassing intended security controls. This exposure could let an attacker access protected resources that should be denied because the IDP is disabled. The weakness is an authorization bypass (CWE‑862).

The flaw affects multiple WSO2 products, including JWT Grant Type for OAuth2, API Control Plane, API Manager, Carbon OAuth, Identity Server and its key‑manager role, Open Banking AM and IAM, Traffic Manager, and Universal Gateway. Specific versions impacted have not been disclosed in the advisory; any installation of these products is potentially vulnerable until a patch is applied.

The likely attack vector is inferred from the description, as no explicit vector is provided. The CVSS score of 4.8 indicates moderate risk, and no EPSS data is available, making it difficult to gauge exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploitation at this time. Attackers can exploit the weakness remotely by sending crafted bearer grant requests to the affected services. The exploitation requires the ability to specify the identity provider in the grant request and target a currently disabled provider. Once the token is issued, the attacker can use it to access resources under the disabled provider’s scope.