---
id: "CVE-2026-6647"
kind: "vulnerability"
aliases: ["CVE-2026-6647"]
title: "WSO2 Identity Server: mixed-case usernames let revoked OAuth tokens stay valid"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["oauth", "package", "self-hosted", "wso2-identity-server"]
not_affected_if: ["default-config", "lowercase-usernames"]
published_at: "2026-10-28T20:18:44+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:36:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6647", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# WSO2 Identity Server: mixed-case usernames let revoked OAuth tokens stay valid

In WSO2 Identity Server deployments with a case-insensitive user store and a case-sensitive identity database, OAuth token revocation fails to match usernames with mixed-case characters. An attacker holding a valid access or refresh token for such a user can keep using it after it should have been revoked, until it expires.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the user store is case-insensitive and the identity database is case-sensitive (unknown for the exact config keys; the sources do not name them)
- Check the WSO2 Identity Server version against the fixed release (unknown; the sources do not say)

## Fix

- Upgrade WSO2 Identity Server to a release that includes the fix (unknown; the sources do not name the fixed version)
- Revoke existing tokens for mixed-case usernames after upgrading (unknown procedure)

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-6647

## From the sources

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated.

A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_