CVE-2025-12627
lowpriority · track · 0EPSS 0.002 · 10 %ileEUUSEPSS · scored 2026-10-29
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/cnnvd
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/enisa_euvd
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4619/Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan