Strix
73.8K

CVE-2026-3583

LOWCVSS 3.1/10EPSS 0.26%

Last modified

CVE-2026-3583 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. EPSS estimates a 0.26% chance of exploitation in the next 30 days.

Description

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

Metrics

CVSS 3.1
3.1/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS Probability
0.26%

18.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 API Manager< 3.1.0; >= 3.1.0, < 3.1.0.367; >= 3.2.0, < 3.2.0.475; >= 3.2.1, < 3.2.1.106; >= 4.0.0, < 4.0.0.394; >= 4.1.0, < 4.1.0.267; >= 4.2.0, < 4.2.0.207; >= 4.3.0, < 4.3.0.120; >= 4.4.0, < 4.4.0.83; >= 4.5.0, < 4.5.0.67; >= 4.6.0, < 4.6.0.29; >= 4.7.0, < 4.7.0.3
WSO2WSO2 Traffic Manager< 4.5.0; >= 4.5.0, < 4.5.0.65; >= 4.6.0, < 4.6.0.29; >= 4.7.0, < 4.7.0.3
WSO2WSO2 Universal Gateway< 4.5.0; >= 4.5.0, < 4.5.0.67; >= 4.6.0, < 4.6.0.29; >= 4.7.0, < 4.7.0.3
WSO2WSO2 API Control Plane< 4.5.0; >= 4.5.0, < 4.5.0.68; >= 4.6.0, < 4.6.0.30; >= 4.7.0, < 4.7.0.3
WSO2WSO2 Identity Server< 5.10.0; >= 5.10.0, < 5.10.0.397; >= 5.11.0, < 5.11.0.444; >= 6.0.0, < 6.0.0.270; >= 6.1.0, < 6.1.0.269; >= 7.0.0, < 7.0.0.152; >= 7.1.0, < 7.1.0.61; >= 7.2.0, < 7.2.0.20; >= 7.3.0, < 7.3.0.1
WSO2WSO2 Open Banking IAM< 2.0.0; >= 2.0.0, < 2.0.0.434
WSO2WSO2 Identity Server as Key Manager< 5.10.0; >= 5.10.0, < 5.10.0.387
WSO2WSO2 Open Banking AM< 2.0.0; >= 2.0.0, < 2.0.0.414
WSO2WSO2 Carbon OAuth>= 6.4.2, < 6.4.2.178; >= 6.4.111, < 6.4.111.174; >= 6.4.176, < 6.4.176.38; >= 6.4.180, < 6.4.180.25; >= 6.8.0, < 6.8.0.59; >= 6.9.6, < 6.9.6.36; >= 6.11.21, < 6.11.21.118; >= 6.13.16, < 6.13.16.32; >= 6.13.19, < 6.13.19.23; >= 6.13.27, < 6.13.27.21; >= 6.13.41, < 6.13.41.9; >= 6.14.14, < 6.14.14.3; >= 7.0.26, < 7.0.26.103; >= 7.0.259, < 7.0.259.54; >= 7.0.385, < 7.0.385.15; >= 7.4.99, < 7.4.99.5

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-3583?
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
How severe is CVE-2026-3583?
CVE-2026-3583 has a CVSS score of 3.1/10 (LOW severity). The EPSS model estimates a 0.26% probability of exploitation in the next 30 days.
How do I fix CVE-2026-3583?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-3583?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST