CVE-2026-3583 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

CVE-2026-3583

Multiple WSO2 products are affected by a vulnerability where the OAuth2 token introspection mechanism fails to immediately invalidate a token in the cache following a revocation request when the allowed_scopes configuration is enabled. This insufficient session expiration (CWE-613) allows a revok...