CVE-2025-13173: Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable the "Revoke token upon user logout" option when session-bound token functionality and token binding validation are enabled.
WSO2 session-bound token flow Revoke token upon user logout = enabled
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
The issue exists when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. Deployments that do not use this combination are not described as affected.
What does an attacker need to exploit it?
An attacker needs possession of a valid session-bound token. They can then continue using that token after the associated user session has been terminated.
What is the immediate mitigation if patching is not available?
Enable the "Revoke token upon user logout" option where session-bound tokens and token binding validation are in use. This addresses the described condition in which tokens remain valid after session termination.
How can administrators determine whether they are exposed?
Review whether session-bound tokens are enabled, token binding validation is enabled, and the "Revoke token upon user logout" option is disabled. The described exposure requires all of those conditions.