CVE-2024-8995 affects multiple versions of WSO2 API Manager by failing to invalidate or remove unused authorization codes issued to deleted users. An attacker with possession of such an authorization code and the associated client credentials (client ID and secret) can reuse these codes to obtain access tokens, thereby gaining unauthorized access to sensitive resources and services within the scope originally granted. This vulnerability is due to insufficient session expiration controls (CWE-613). The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There is no known exploit in the wild and no vendor-provided patch or remediation at this time.

The vulnerability allows unauthorized access to sensitive resources by reusing authorization codes that should have been invalidated after user deletion. This can lead to unauthorized access to services and data within the scope of the compromised authorization code. The impact is limited to confidentiality and integrity with low severity and does not affect availability. Exploitation requires possession of both the authorization code and client credentials, and the attack complexity is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider monitoring for suspicious use of authorization codes and client credentials, and review their token lifecycle management policies. No official remediation or temporary fix has been published by the vendor at this time.