CVE-2025-12627: Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user.
An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12627?
The severity of CVE-2025-12627 is classified as low with a score of 2.4.
How do I fix CVE-2025-12627?
To fix CVE-2025-12627, ensure proper management of refresh tokens in WSO2 Identity Server to secure impersonated sessions.
What type of attack does CVE-2025-12627 enable?
CVE-2025-12627 enables unauthorized actions by allowing an attacker to use obtained refresh tokens from impersonated sessions.
Which software is affected by CVE-2025-12627?
CVE-2025-12627 affects WSO2 Identity Server.
What does improper refresh token implementation mean in the context of CVE-2025-12627?
In the context of CVE-2025-12627, improper refresh token implementation refers to the failure to adequately manage refresh tokens during user impersonation, leading to security vulnerabilities.