CVE-2026-6647: Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated.
A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are affected when WSO2 Identity Server uses a case-insensitive user store together with a case-sensitive database for identity data. The issue concerns accounts whose usernames contain mixed-case characters.
What does an attacker need to exploit the issue?
The attacker must already possess a valid access token or refresh token associated with a mixed-case username. No user interaction is required, and the token can be used until it expires if the expected revocation fails.
When can the access-control bypass occur?
It can occur during lifecycle events that are expected to revoke OAuth tokens. If case handling prevents the revocation operation from identifying the username correctly, the token may remain valid and permit actions that should have been restricted.