Wazuh 4.0.0 through 4.14.7 fails to invalidate issued tokens for run_as users with zero static roles because the check_token function never consults the blacklist. This flaw lets an attacker who has had administrator privileges revoked keep authenticating with a valid token and re‑assign the administrator role to themselves, thereby maintaining unrestricted access. The weakness represents insecure token handling, and can be leveraged by any entity that can trigger the check_token routine, potentially including internal users or compromised services.

The vulnerability affects the Wazuh Manager component (wazuh:wazuh-manager). Versions from 4.0.0 through 4.14.7 are susceptible; the issue is resolved starting with the 4.14.8 release. No other vendors or products are impacted according to the CNA data.

The CVSS score of 8.6 indicates high severity, and while no EPSS value is disclosed, the vulnerability is not listed in CISA KEV. Attackers can exploit the bypass by issuing or reusing a valid token—particularly after revocation—without the system recognizing the revocation, resulting in persistent privileged access. The required conditions are a run_as user with zero static roles and the ability to interact with the check_token API endpoint; the attack is most likely performed from within the managed environment, so internal compromise or privilege escalation could trigger it.