Login Request a demo
WC
Product
WSO2 Carbon OAuth
by WSO2 · last CVE Oct 21, 2026
4
CVEs
0
On KEV
6.5
Max CVSS
2
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 0Medium 2Low 1
Severity
All severities4Critical0High0Medium2Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WSO2 Carbon OAuth to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-13173
6.5
0%
Oct 19
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Affected: 6.4.2 before 6.4.2.171; 6.4.111 before 6.4.111.165; 6.4.176 before 6.4.176.30; 6.4.180 before 6.4.180.14; 6.8.0 before 6.8.0.54; 6.9.6 before 6.9.6.29; +8 more
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 6.4.2 before 6.4.2.154; 6.4.111 before 6.4.111.131; 6.4.176 before 6.4.176.35; 6.4.180 before 6.4.180.17; 6.8.0 before 6.8.0.46; 6.9.6 before 6.9.6.34; +5 more
CVE-2025-12627
2.4
0%
Aug 6
Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
Affected: 7.0.26 before 7.0.26.83; 7.0.259 before 7.0.259.31
CVE-2025-0326
New
–
0%
Oct 21
Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
Affected: 7.0.26 before 7.0.26.51
Showing 4