{"id":"CVE-2024-9517","kind":"vulnerability","aliases":["CVE-2024-9517"],"related":[],"title":"WSO2 products: refresh tokens still issue access tokens for blocked accounts","description":"The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.\n\nThis vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.","summary":"WSO2 products do not re-check account status when a refresh token is exchanged for a new access token. A blocked user can keep obtaining valid access tokens and act as that account.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity-server","oauth2","other","wso2"],"not_affected_if":["no-refresh-token-grant","no-user-store-blocking"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T12:16:57+00:00","first_seen_at":"2026-11-02T12:23:05+00:00","triaged_at":"2026-11-02T12:24:12+00:00","updated_at":"2026-11-02T12:24:12+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T12:24:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WSO2 products: refresh tokens still issue access tokens for blocked accounts","impact":"high","summary":"WSO2 products do not re-check account status when a refresh token is exchanged for a new access token. A blocked user can keep obtaining valid access tokens and act as that account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wso2","identity-server","oauth2"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"blocked accounts keep valid access tokens and act on resources","analyst_note":"Find the affected WSO2 product versions and fixed releases from the NVD entry or WSO2 security advisory.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-refresh-token-grant","no-user-store-blocking"],"who_is_affected":"Organizations running WSO2 identity or API management products that use the OAuth2 refresh token grant with a user store. Exposure depends on whether accounts are blocked in the user store and whether refresh tokens remain valid after blocking. unknown for the exact affected product versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":4193,"output_tokens":448,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':13A,16A '-9517':14A,17A 'access':7A,42B,51B,76C,86C,111C 'account':11A,31B,57B,71C,90C,102C,114C,146C 'act':54B 'action':125C 'allow':80C 'associ':117C 'attack':82C,119C 'behalf':127C 'block':10A,45B,96C,129C 'bypass':101C 'check':30B 'compromis':145C 'cve':12A,15A 'data':137C 'depend':139C 'escal':135C 'even':91C 'exchang':38B 'exfiltr':138C 'fail':66C 'grant':61C 'ident':19B 'identity-serv':18B 'issu':6A,74C 'keep':48B 'lead':108C,132C 'leverag':121C 'lockout':103C 'mechan':104C 'new':41B,75C 'oauth2':21B 'obtain':49B,84C 'perform':124C 'permiss':142C 'potenti':131C 'privileg':134C 'product':2A,25B,65C 're':29B,69C 're-check':28B 're-valid':68C 'refresh':3A,35B,59C 'resourc':118C 'server':20B 'status':32B,72C 'still':5A 'store':100C 'token':4A,8A,36B,43B,52B,60C,77C,87C 'type':62C 'unauthor':110C 'user':46B,89C,99C,113C,130C 'valid':50B,70C,85C 'vulner':106C 'weak':79C 'wso2':1A,23B,24B,64C","nicknames":[],"mitigations":[],"who_affected":"Organizations running WSO2 identity or API management products that use the OAuth2 refresh token grant with a user store. Exposure depends on whether accounts are blocked in the user store and whether refresh tokens remain valid after blocking. unknown for the exact affected product versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identityserver","medium","oauth2","other","wso2"],"first_public_at":"2026-11-02T12:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-9517","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9517","severity":null,"published_at":"2026-11-02T12:16:57+00:00","modified_at":"2026-11-02T12:16:57+00:00","first_seen_at":"2026-11-02T12:23:05+00:00","fetched_at":"2026-11-02T12:23:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}