---
id: "CVE-2024-9517"
kind: "vulnerability"
aliases: ["CVE-2024-9517"]
title: "WSO2 products: refresh tokens still issue access tokens for blocked accounts"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["identity-server", "oauth2", "other", "wso2"]
not_affected_if: ["no-refresh-token-grant", "no-user-store-blocking"]
published_at: "2026-11-02T12:16:57+00:00"
first_seen_at: "2026-11-02T12:23:05+00:00"
updated_at: "2026-11-02T12:24:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9517", "first_seen_at": "2026-11-02T12:23:05+00:00"}]
---

# WSO2 products: refresh tokens still issue access tokens for blocked accounts

WSO2 products do not re-check account status when a refresh token is exchanged for a new access token. A blocked user can keep obtaining valid access tokens and act as that account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T12:23:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-9517

## From the sources

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.

This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_