The vulnerability CVE-2025-12627 in WSO2 Identity Server affects versions 7.0.0 and 7.1.0. It involves insufficient session expiration in the user impersonation flow, specifically the failure to properly manage refresh tokens associated with impersonated sessions. An attacker who obtains an access token for an impersonated user can exploit the refresh token grant to obtain new access tokens, thereby extending their ability to act as the legitimate user beyond the intended session duration. This undermines log integrity and traceability by obscuring the true actor behind actions performed during the impersonated session. The CVSS v3.1 base score is 2.4, indicating low severity with attack vector as adjacent network, low complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker with access to an impersonated user's access token to renew their authorization indefinitely by leveraging the refresh token grant. This extends the attacker's ability to perform actions on behalf of the legitimate user, potentially compromising the integrity of logs and audit trails by masking the true actor. There is no direct impact on confidentiality or availability reported. The overall impact is limited to integrity concerns related to session management and traceability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor for unusual token refresh activity related to impersonated sessions and consider restricting the use of impersonation features to trusted administrators. No official remediation or temporary fix has been published by the vendor at this time.