Live › vulnerability › CVE-2026-6647
Go to dashboardIn WSO2 Identity Server deployments with a case-insensitive user store and a case-sensitive identity database, OAuth token revocation fails to match usernames with mixed-case characters. An attacker holding a valid access or refresh token for such a user can keep using it after it should have been revoked, until it expires.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Only deployments that combine a case-insensitive user store with a case-sensitive database for identity data are described as affected. Deployments where both are case-sensitive, or where usernames are all lowercase, are unlikely to be exposed, though the sources do not state this explicitly.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated.
A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.
This page as .md · .json · in your agent: get_signal("CVE-2026-6647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.