{"id":"CVE-2026-6647","kind":"vulnerability","aliases":["CVE-2026-6647"],"related":[],"title":"WSO2 Identity Server: mixed-case usernames let revoked OAuth tokens stay valid","description":"In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated.\n\nA malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.","summary":"In WSO2 Identity Server deployments with a case-insensitive user store and a case-sensitive identity database, OAuth token revocation fails to match usernames with mixed-case characters. An attacker holding a valid access or refresh token for such a user can keep using it after it should have been revoked, until it expires.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oauth","package","self-hosted","wso2-identity-server"],"not_affected_if":["default-config","lowercase-usernames"],"how_to_check":"- Check whether the user store is case-insensitive and the identity database is case-sensitive (unknown for the exact config keys; the sources do not name them)\n- Check the WSO2 Identity Server version against the fixed release (unknown; the sources do not say)","fix":"- Upgrade WSO2 Identity Server to a release that includes the fix (unknown; the sources do not name the fixed version)\n- Revoke existing tokens for mixed-case usernames after upgrading (unknown procedure)","status":"open","published_at":"2026-10-28T20:18:44+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:14+00:00","updated_at":"2026-10-28T20:36:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T20:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WSO2 Identity Server to a release that includes the fix (unknown; the sources do not name the fixed version)\n- Revoke existing tokens for mixed-case usernames after upgrading (unknown procedure)","reach":"network","title":"WSO2 Identity Server: mixed-case usernames let revoked OAuth tokens stay valid","impact":"medium","summary":"In WSO2 Identity Server deployments with a case-insensitive user store and a case-sensitive identity database, OAuth token revocation fails to match usernames with mixed-case characters. An attacker holding a valid access or refresh token for such a user can keep using it after it should have been revoked, until it expires.","category":"package","nicknames":[],"who_cares":["wso2-identity-server","oauth","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"revoked tokens keep working and bypass intended access controls","analyst_note":"Find the fixed WSO2 Identity Server version and the exact configuration keys for the case-sensitivity mismatch in the NVD entry or WSO2 security advisory.","how_to_check":"- Check whether the user store is case-insensitive and the identity database is case-sensitive (unknown for the exact config keys; the sources do not name them)\n- Check the WSO2 Identity Server version against the fixed release (unknown; the sources do not say)","needs_analyst":true,"not_affected_if":["default-config","lowercase-usernames"],"who_is_affected":"Only deployments that combine a case-insensitive user store with a case-sensitive database for identity data are described as affected. Deployments where both are case-sensitive, or where usernames are all lowercase, are unlikely to be exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3445,"output_tokens":639,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-6647':16A,19A 'access':65B,154C,199C 'action':190C 'actor':145C,177C 'affect':166C 'associ':158C 'attack':61B 'bypass':197C 'case':6A,37B,44B,58B,96C,103C,112C,132C,163C 'case-insensit':36B,95C 'case-sensit':43B,102C 'certain':135C 'charact':59B,133C 'configur':92C,167C 'contain':129C 'continu':188C 'control':200C 'correct':126C 'cve':14A,17A 'data':108C 'databas':47B,105C 'deploy':33B,87C 'effect':196C 'event':137C 'expect':175C 'expir':85B 'expiri':186C 'exploit':147C 'fail':51B,124C 'handl':113C 'hold':62B 'host':24B 'ident':2A,27B,31B,46B,90C,107C 'identifi':127C 'inconsist':117C 'insensit':38B,97C 'intend':198C 'invalid':142C 'keep':74B 'let':8A 'leverag':180C 'lifecycl':136C 'malici':144C 'match':53B 'may':170C 'mismatch':109C 'mix':5A,57B,131C,162C 'mixed-cas':4A,56B,130C,161C 'oauth':10A,20B,48B,120C 'occur':115C 'oper':123C 'packag':21B 'perform':189C 'possess':151C 'prevent':138C 'refresh':67B,156C 'restrict':195C 'result':118C 'revoc':50B,122C 'revok':9A,82B,173C 'self':23B 'self-host':22B 'sensit':45B,104C 'server':3A,28B,32B,91C 'stay':12A 'store':40B,99C 'token':11A,49B,68B,121C,139C,157C,169C,183C 'unrevok':182C 'use':75B 'user':39B,72B,98C 'usernam':7A,54B,111C,128C,164C 'valid':13A,64B,153C 'vulner':149C 'wso2':1A,26B,30B,89C 'wso2-identity-server':25B","nicknames":[],"mitigations":[],"who_affected":"Only deployments that combine a case-insensitive user store with a case-sensitive database for identity data are described as affected. Deployments where both are case-sensitive, or where usernames are all lowercase, are unlikely to be exposed, though the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-6647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6647","severity":null,"published_at":"2026-10-28T20:18:44+00:00","modified_at":"2026-10-28T20:18:44+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}