WSO2 Identity Server deployments that use a case-insensitive user store alongside a case-sensitive database for identity data may experience failures in OAuth token revocation. This occurs because username case mismatches prevent proper identification of tokens associated with mixed-case usernames, allowing tokens to remain valid beyond intended revocation events. An attacker with a valid token for such a username could exploit this to maintain unauthorized access until token expiry.