In deployments of WSO2 Identity Server where the user store is case‑insensitive but the database is case‑sensitive, a mismatch in username case handling can cause OAuth token revocation operations to miss users whose usernames contain mixed‑case characters during certain lifecycle events. Consequently, valid access or refresh tokens tied to such usernames fail to be invalidated and remain usable beyond their intended window, allowing an attacker possessing such a token to continue performing actions that should have been restricted.

WSO2 Carbon OAuth and WSO2 Identity Server are affected when configured with a case‑insensitive user store and a case‑sensitive database for identity data. No specific product versions are listed; the vulnerability exists in all configurations that meet these conditions.

The CVSS score of 7.4 indicates high risk, and the EPSS score is not available, while the vulnerability is not listed in CISA KEV. Based on the description, the attacker must hold a valid token and trigger a lifecycle event that initiates token revocation; this implies that the threat is most likely carried out by an authenticated or insider actor who can submit the revocation request, although a stolen token could also enable an external attacker. The vulnerability remains new and publicly unexploited, but the conditions for exploitation are clearly defined by the description.