CVE-2024-9517 is a vulnerability in WSO2 products where the refresh token grant type does not re-validate the account status before issuing new access tokens. This flaw allows attackers to obtain valid access tokens for accounts that have been blocked, bypassing account lockout protections. The vulnerability can lead to unauthorized access and potential privilege escalation or data exfiltration depending on the compromised account's permissions.