CVE-2024-8995

🗓️ 06 Aug 2026 08:16:27Reported by [email protected]Type

nvd🔗 web.nvd.nist.gov👁 11 Views

Unused codes from deleted users can be reused with client credentials to obtain tokens.

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2024-8995	6 Aug 202607:32	–	attackerkb
CVE	CVE-2024-8995	6 Aug 202607:32	–	cve
Cvelist	CVE-2024-8995 Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access	6 Aug 202607:32	–	cvelist
EUVD	EUVD-2024-55706	6 Aug 202607:32	–	euvd
Vulnrichment	CVE-2024-8995 Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access	6 Aug 202607:32	–	vulnrichment

NVD

Node

OR

wso2 api_control_planeRange4.5.0–4.5.0.56

wso2 api_control_planeRange4.6.0–4.6.0.20

wso2 api_managerRange3.1.0–3.1.0.320

wso2 api_managerRange3.2.0–3.2.0.413

wso2 api_managerRange3.2.1–3.2.1.90

wso2 api_managerRange4.0.0–4.0.0.334

wso2 api_managerRange4.1.0–4.1.0.255

wso2 api_managerRange4.2.0–4.2.0.195

wso2 api_managerRange4.3.0–4.3.0.106

wso2 api_managerRange4.4.0–4.4.0.70

wso2 api_managerRange4.5.0–4.5.0.55

wso2 api_managerRange4.6.0–4.6.0.19

wso2 identity_serverRange5.10.0–5.10.0.338

wso2 identity_serverRange5.11.0–5.11.0.395

wso2 identity_serverRange6.0.0–6.0.0.229

wso2 identity_serverRange6.1.0–6.1.0.208

wso2 identity_server_as_key_managerRange5.10.0–5.10.0.338

wso2 open_banking_amRange2.0.0–2.0.0.369

wso2 open_banking_iamRange2.0.0–2.0.0.389

wso2 traffic_managerRange4.5.0–4.5.0.54

wso2 traffic_managerRange4.6.0–4.6.0.19

wso2 universal_gatewayRange4.5.0–4.5.0.55

wso2 universal_gatewayRange4.6.0–4.6.0.19

Source	Link
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-2753/

13 Aug 2026 13:18Current

CVSS 3.14.9

EPSS0.00119

authorization codes deleted users client credentials access tokens security vulnerability