When WSO2 products are configured with the allowed_scopes setting, the OAuth2 introspection service fails to purge cached tokens immediately after a revocation request. A token that was introspected just before revocation can continue to be returned to the client until the cache entry is cleared. This means a revoked token may be presented to the client again, even though it is no longer considered valid for API calls, and the client may be prevented from obtaining a new token until the cache is invalidated. The weakness is a form of authentication bypass, classified as CWE-613.

The vulnerability affects a range of WSO2 products: API Control Plane, API Manager, Carbon OAuth, Identity Server, Identity Server as Key Manager, Open Banking API Manager, Open Banking Identity and Access Management, Traffic Manager, and Universal Gateway. Version information was not specified in the advisory; all affected releases should be reviewed based on the advisory notice.

The CVSS score of 3.1 indicates low severity; no EPSS score is available and the issue is not listed in CISA’s KEV catalog. The likely attack vector involves remote interaction with OAuth2 endpoints, requiring the ability to issue revocation requests or introspect tokens. An attacker might exploit the delayed cache invalidation to cause a revoked token to be re‑issued to a client, disrupting authentication flows, but the vector does not enable direct remote code execution or data exfiltration.