The vulnerability CVE-2025-12627 in WSO2 Identity Server affects versions 7.0.0 and 7.1.0. It involves insufficient session expiration in the user impersonation flow, specifically the improper management of refresh tokens tied to impersonated sessions. An attacker who has obtained an access token for an impersonated user can exploit the refresh token grant to renew access tokens, thereby extending their ability to act as the legitimate user beyond the intended session lifetime. This undermines log integrity and traceability by obscuring the actual actor behind actions performed using the impersonated session.

An attacker with access to an impersonated user's access token can continue to renew authorization by abusing refresh tokens, allowing prolonged unauthorized actions on behalf of the legitimate user. This compromises the integrity of logs and audit trails by masking the true actor. There is no direct impact on confidentiality or availability reported. The overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications for updates and apply patches once available.