WSO2 IS Session-Token Revocation Failure (SSO)
CVE-2025-13173 Published on October 19, 2026
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Vulnerability Analysis
CVE-2025-13173 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Products Associated with CVE-2025-13173
Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.
Affected Versions
WSO2 API Control Plane:- Before 4.5.0 is unknown.
- Version 4.5.0 and below 4.5.0.47 is affected.
- Version 4.6.0 and below 4.6.0.13 is affected.
- Before 4.5.0 is unknown.
- Version 4.5.0 and below 4.5.0.46 is affected.
- Version 4.6.0 and below 4.6.0.11 is affected.
- Before 3.1.0 is unknown.
- Version 3.1.0 and below 3.1.0.352 is affected.
- Version 3.2.0 and below 3.2.0.456 is affected.
- Version 3.2.1 and below 3.2.1.81 is affected.
- Version 4.0.0 and below 4.0.0.376 is affected.
- Version 4.1.0 and below 4.1.0.246 is affected.
- Version 4.2.0 and below 4.2.0.186 is affected.
- Version 4.3.0 and below 4.3.0.97 is affected.
- Version 4.4.0 and below 4.4.0.61 is affected.
- Version 4.5.0 and below 4.5.0.46 is affected.
- Version 4.6.0 and below 4.6.0.11 is affected.
- Before 4.5.0 is unknown.
- Version 4.5.0 and below 4.5.0.45 is affected.
- Version 4.6.0 and below 4.6.0.11 is affected.
- Before 5.10.0 is unknown.
- Version 5.10.0 and below 5.10.0.372 is affected.
- Before 2.0.0 is unknown.
- Version 2.0.0 and below 2.0.0.421 is affected.
- Before 2.0.0 is unknown.
- Version 2.0.0 and below 2.0.0.401 is affected.
- Before 5.10.0 is unknown.
- Version 5.10.0 and below 5.10.0.381 is affected.
- Version 5.11.0 and below 5.11.0.428 is affected.
- Version 6.0.0 and below 6.0.0.255 is affected.
- Version 6.1.0 and below 6.1.0.256 is affected.
- Version 7.0.0 and below 7.0.0.133 is affected.
- Version 7.1.0 and below 7.1.0.41 is affected.
- Version 7.2.0 and below 7.2.0.3 is affected.
- Version 6.4.2 and below 6.4.2.171 is affected.
- Version 6.4.111 and below 6.4.111.165 is affected.
- Version 6.4.176 and below 6.4.176.30 is affected.
- Version 6.4.180 and below 6.4.180.14 is affected.
- Version 6.8.0 and below 6.8.0.54 is affected.
- Version 6.9.6 and below 6.9.6.29 is affected.
- Version 6.11.21 and below 6.11.21.94 is affected.
- Version 6.13.16 and below 6.13.16.21 is affected.
- Version 6.13.19 and below 6.13.19.14 is affected.
- Version 6.13.27 and below 6.13.27.10 is affected.
- Version 6.13.41 and below 6.13.41.1 is affected.
- Version 7.0.26 and below 7.0.26.87 is affected.
- Version 7.0.259 and below 7.0.259.34 is affected.
- Version 7.0.385 and below 7.0.385.3 is affected.