6.5

CVE-2025-13173: wso2 wso2 api control plane Insufficient Session Expiration

CVSS: 6.5v3.1MediumAwaiting analysis
Published 19-10-2026Last modified 20-10-2026
Open JSON

Vulnerability summary

CVE-2025-13173 is a medium (CVSS 6.5) Insufficient Session Expiration vulnerability in wso2 wso2 api control plane. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.7% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 19-10-2026
    PublishedVulnerability first disclosed.
  2. 20-10-2026
    Last modifiedVulnerability information updated.

Description

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

20-10-202620-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Wso29 products
  • wso2 api control plane≥ 4.5.0, < 4.5.0.47 | ≥ 4.6.0, < 4.6.0.13
  • wso2 api manager≥ 3.1.0, < 3.1.0.352 | ≥ 3.2.0, < 3.2.0.456 | ≥ 3.2.1, < 3.2.1.81 | ≥ 4.0.0, < 4.0.0.376 | ≥ 4.1.0, < 4.1.0.246 | ≥ 4.2.0, < 4.2.0.186 | ≥ 4.3.0, < 4.3.0.97 | ≥ 4.4.0, < 4.4.0.61 | ≥ 4.5.0, < 4.5.0.46 | ≥ 4.6.0, < 4.6.0.11
  • wso2 carbon oauth≥ 6.4.2, < 6.4.2.171 | ≥ 6.4.111, < 6.4.111.165 | ≥ 6.4.176, < 6.4.176.30 | ≥ 6.4.180, < 6.4.180.14 | ≥ 6.8.0, < 6.8.0.54 | ≥ 6.9.6, < 6.9.6.29 | ≥ 6.11.21, < 6.11.21.94 | ≥ 6.13.16, < 6.13.16.21 | ≥ 6.13.19, < 6.13.19.14 | ≥ 6.13.27, < 6.13.27.10 | ≥ 6.13.41, < 6.13.41.1 | ≥ 7.0.26, < 7.0.26.87 | ≥ 7.0.259, < 7.0.259.34 | ≥ 7.0.385, < 7.0.385.3
  • wso2 identity server≥ 5.10.0, < 5.10.0.381 | ≥ 5.11.0, < 5.11.0.428 | ≥ 6.0.0, < 6.0.0.255 | ≥ 6.1.0, < 6.1.0.256 | ≥ 7.0.0, < 7.0.0.133 | ≥ 7.1.0, < 7.1.0.41 | ≥ 7.2.0, < 7.2.0.3
  • wso2 identity server as key manager≥ 5.10.0, < 5.10.0.372

1 vendor · 9 products

References

1 links