CVE-2025-13173

published 2026-10-19

CVE-2025-13173: Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs…

Priority P3 39 medium 6.5 CVSS 3.1

AV N AC H PR N UI N S C C L I L A L

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.

This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

Affected

40 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.47	4.5.0.47
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.13	4.6.0.13
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.352	3.1.0.352
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.456	3.2.0.456
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.81	3.2.1.81
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.376	4.0.0.376
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.246	4.1.0.246
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.186	4.2.0.186
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.97	4.3.0.97
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.61	4.4.0.61
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.46	4.5.0.46
wso2	wso2_api_manager	>= 4.6.0 < 4.6.0.11	4.6.0.11
wso2	wso2_carbon_oauth	>= 6.11.21 < 6.11.21.94	6.11.21.94
wso2	wso2_carbon_oauth	>= 6.13.16 < 6.13.16.21	6.13.16.21
wso2	wso2_carbon_oauth	>= 6.13.19 < 6.13.19.14	6.13.19.14
wso2	wso2_carbon_oauth	>= 6.13.27 < 6.13.27.10	6.13.27.10
wso2	wso2_carbon_oauth	>= 6.13.41 < 6.13.41.1	6.13.41.1
wso2	wso2_carbon_oauth	>= 6.4.111 < 6.4.111.165	6.4.111.165
wso2	wso2_carbon_oauth	>= 6.4.176 < 6.4.176.30	6.4.176.30
wso2	wso2_carbon_oauth	>= 6.4.180 < 6.4.180.14	6.4.180.14
wso2	wso2_carbon_oauth	>= 6.4.2 < 6.4.2.171	6.4.2.171
wso2	wso2_carbon_oauth	>= 6.8.0 < 6.8.0.54	6.8.0.54
wso2	wso2_carbon_oauth	>= 6.9.6 < 6.9.6.29	6.9.6.29
wso2	wso2_carbon_oauth	>= 7.0.259 < 7.0.259.34	7.0.259.34
wso2	wso2_carbon_oauth	>= 7.0.26 < 7.0.26.87	7.0.26.87

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-613