Threats tagged 'ghsa-66c7-2f58-rwhj'

WSO2 API Manager versions 3.1.0 through 4.6.0 have a vulnerability where unused authorization codes issued to deleted users are not properly invalidated. This allows these codes to persist and potentially be reused by attackers who have the authorization code and client credentials, enabling unauthorized access to resources within the scope of the original authorization.