

Security Advisory WSO2-2025-4619/CVE-2025-12627

Published: 2026-05-03

Version: 1.0.0

Severity: Low

CVSS Score: 2.4 (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

CVE IDs: CVE-2025-12627

---

AFFECTED PRODUCTS

• WSO2 Identity Server: 7.1.0, 7.0.0

OVERVIEW

Improper refresh token implementation flow on User Impersonation.

DESCRIPTION

Improper refresh token implementation flow on User Impersonation.

IMPACT

An impersonator who obtains an access token through the impersonation flow could use the refresh token grant to renew the token and continue performing actions as the actual user instead of as the impersonator. This behavior compromises the integrity and traceability of product logs.

SOLUTION

Community Users (Open Source)

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2-extensions/identity-inbound-auth-oauth/pull/2950

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders

Update your product to the specified update level, or to a higher update level, to mitigate the identified vulnerability.

Info

WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.

Product Name	Product Version	Update Level
WSO2 Identity Server	7.1.0	38
WSO2 Identity Server	7.0.0	130