This vulnerability (CWE-613) in WSO2 Identity Server 5.2.0 involves insufficient session expiration controls. When a user account is locked, the system fails to revoke or invalidate active access tokens associated with that account. Consequently, these tokens remain valid and usable, allowing continued access to protected resources despite the account being locked. The CVSS 3.1 score is 6.0 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality, integrity, and availability.

The impact is that locked user accounts can maintain access to protected resources using existing valid tokens, effectively bypassing the intended access control restrictions. This could lead to unauthorized data access or actions until the tokens expire naturally. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor vendor communications for updates and consider additional compensating controls to limit token lifetime or enforce manual token revocation upon account lock if feasible.