CVE-2025-0326: CWE-613: Insufficient Session Expiration in WSO2 WSO2 Identity Server

CVE-2025-0326 describes a vulnerability in WSO2 Identity Server where access tokens associated with sub-organization users are not invalidated during critical account management operations. This insufficient session expiration (CWE-613) means that tokens remain valid even after password resets, role changes, or sub-organization disablement, potentially allowing unauthorized access if those tokens are exposed to malicious actors. The vulnerability affects versions >=7.0.0 <7.0.0.85 and >=7.0.26 <7.0.26.51.

If exploited, an attacker who has obtained previously issued access tokens could maintain unauthorized access to resources even after administrative actions intended to revoke or modify user access. However, exploitation requires that the tokens remain active and are exposed to malicious actors. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, organizations should consider additional controls around token exposure and monitor for suspicious token usage related to sub-organization users undergoing sensitive account changes.