CVE-2024-8995 is an insufficient session expiration vulnerability (CWE-613) in WSO2 API Manager. Authorization codes issued to users who have been deleted are not invalidated or removed, allowing these codes to remain valid. An attacker possessing both the authorization code and the associated client credentials (client ID and secret) can reuse these codes to obtain access tokens on behalf of deleted users. This can lead to unauthorized access to sensitive resources and services, depending on the scopes authorized by the compromised code. The vulnerability affects multiple versions from 3.1.0 through 4.6.0. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

The vulnerability allows attackers with access to unused authorization codes and client credentials to obtain access tokens for deleted users, potentially granting unauthorized access to sensitive resources within the scope of the original authorization. The CVSS score of 4.9 (medium severity) reflects limited attack complexity and low privileges required, but with potential confidentiality and integrity impacts. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider restricting access to authorization codes and client credentials, and monitor for unusual token issuance patterns related to deleted users. Follow vendor updates closely for an official fix or mitigation instructions.