Live › vulnerability › CVE-2024-9517
WSO2 products do not re-check account status when a refresh token is exchanged for a new access token. A blocked user can keep obtaining valid access tokens and act as that account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 12:23 UTC. All times on this page are UTC.
Organizations running WSO2 identity or API management products that use the OAuth2 refresh token grant with a user store. Exposure depends on whether accounts are blocked in the user store and whether refresh tokens remain valid after blocking. unknown for the exact affected product versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.
This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
This page as .md · .json · in your agent: get_signal("CVE-2024-9517")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.