Login Request a demo
WC
Product
WSO2 Carbon OAuth
by WSO2 · last CVE Oct 28, 2026
6
CVEs
0
On KEV
7.4
Max CVSS
4
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 1Medium 2Low 2
Severity
All severities6Critical0High1Medium2Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WSO2 Carbon OAuth to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-3583
New
3.1–Oct 28
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Affected: 6.4.2 before 6.4.2.178; 6.4.111 before 6.4.111.174; 6.4.176 before 6.4.176.38; 6.4.180 before 6.4.180.25; 6.8.0 before 6.8.0.59; 6.9.6 before 6.9.6.36; +10 more
CVE-2025-12627
2.4
0%
Aug 6
Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
Affected: 7.0.26 before 7.0.26.83; 7.0.259 before 7.0.259.31
Showing 2