Strix
74.7K

CVE-2025-13173

MEDIUMCVSS 6.5/10EPSS 0.19%

Last modified

CVE-2025-13173 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. EPSS estimates a 0.19% chance of exploitation in the next 30 days.

Description

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS Probability
0.19%

9.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 API Control Plane< 4.5.0; >= 4.5.0, < 4.5.0.47; >= 4.6.0, < 4.6.0.13
WSO2WSO2 Universal Gateway< 4.5.0; >= 4.5.0, < 4.5.0.46; >= 4.6.0, < 4.6.0.11
WSO2WSO2 API Manager< 3.1.0; >= 3.1.0, < 3.1.0.352; >= 3.2.0, < 3.2.0.456; >= 3.2.1, < 3.2.1.81; >= 4.0.0, < 4.0.0.376; >= 4.1.0, < 4.1.0.246; >= 4.2.0, < 4.2.0.186; >= 4.3.0, < 4.3.0.97; >= 4.4.0, < 4.4.0.61; >= 4.5.0, < 4.5.0.46; >= 4.6.0, < 4.6.0.11
WSO2WSO2 Traffic Manager< 4.5.0; >= 4.5.0, < 4.5.0.45; >= 4.6.0, < 4.6.0.11
WSO2WSO2 Identity Server as Key Manager< 5.10.0; >= 5.10.0, < 5.10.0.372
WSO2WSO2 Open Banking IAM< 2.0.0; >= 2.0.0, < 2.0.0.421
WSO2WSO2 Open Banking AM< 2.0.0; >= 2.0.0, < 2.0.0.401
WSO2WSO2 Identity Server< 5.10.0; >= 5.10.0, < 5.10.0.381; >= 5.11.0, < 5.11.0.428; >= 6.0.0, < 6.0.0.255; >= 6.1.0, < 6.1.0.256; >= 7.0.0, < 7.0.0.133; >= 7.1.0, < 7.1.0.41; >= 7.2.0, < 7.2.0.3
WSO2WSO2 Carbon OAuth>= 6.4.2, < 6.4.2.171; >= 6.4.111, < 6.4.111.165; >= 6.4.176, < 6.4.176.30; >= 6.4.180, < 6.4.180.14; >= 6.8.0, < 6.8.0.54; >= 6.9.6, < 6.9.6.29; >= 6.11.21, < 6.11.21.94; >= 6.13.16, < 6.13.16.21; >= 6.13.19, < 6.13.19.14; >= 6.13.27, < 6.13.27.10; >= 6.13.41, < 6.13.41.1; >= 7.0.26, < 7.0.26.87; >= 7.0.259, < 7.0.259.34; >= 7.0.385, < 7.0.385.3

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2025-13173?
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
How severe is CVE-2025-13173?
CVE-2025-13173 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.19% probability of exploitation in the next 30 days.
How do I fix CVE-2025-13173?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-13173?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST