CVE-2025-12627 Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.130",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1.0",
        "lessThan": "7.1.0.38",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon OAuth",
    "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.26",
        "lessThan": "7.0.26.83",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.259",
        "lessThan": "7.0.259.31",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "x",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]