CVE-2025-0326

WSO2 Identity Server and WSO2 Carbon OAuth are vulnerable to an insufficient session expiration issue (CVE-2025-0326 ). The system fails to invalidate existing access tokens for sub-organization users during sensitive account management operations, such as password resets , role changes , or sub-...

CVE-2025-0326 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's...

CVE-2014-5253

OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain...