Skip to content

CVE record · 1 source

CVE-2026-3583

CVSS 3.1

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache…

Vendor: WSO2
Product: WSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway, WSO2 API Control Plane
CVSS v3.1: 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-613
Exposure class: Identity

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

14

CVE NVD 3d ago

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache…

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that…

CVSS 3.1 CVE-2026-3583 WSO2