What is CVE-2025-12627?

CVE-2025-12627 is a low-severity vulnerability in Wso2 Carbon Oauth, classified under Insufficient Session Expiration. CVSS score: 2.4/10. Published 2026-08-06.

How severe is CVE-2025-12627?

Low severity. CVSS v3 base score is 2.4 out of 10.

Vulnerability in Wso2 Carbon Oauth

CVE-2025-12627

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh to…

CVSS v3 metric

CVSS v3 base score 2.4 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N.

Affected products

Wso2 Carbon Oauth — versions 7.0.26, 7.0.259, x
Wso2 Identity Server — versions 7.0.0, 7.1.0

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory)

Frequently asked questions

What is CVE-2025-12627?: CVE-2025-12627 is a low-severity vulnerability in Wso2 Carbon Oauth, classified under Insufficient Session Expiration. CVSS score: 2.4/10. Published 2026-08-06.
How severe is CVE-2025-12627?: Low severity. CVSS v3 base score is 2.4 out of 10.