CVE-2025-1397: Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.
A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.
Remediation
Information
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
The affected deployment must use JWT Bearer or SAML2 Bearer grant types and have a disabled Identity Provider that can be targeted. The supplied vector indicates network exploitation with no required privileges or user interaction, although attack complexity is rated high.
What should teams do if they cannot patch immediately?
The provided information does not specify a workaround or compensating control. Follow the remediation instructions in the referenced WSO2 security advisory.