CVE-2024-8995

medium

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system.

Vendor / product: Wso2 — api control plane

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.

CVSS

4.9

4.9 (CVSS v3.1)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)

Timeline (UTC)

Published: 2026-08-06 08:16

Modified: 2026-10-27 18:10

NVD status: Analyzed

Last synced 18 hours ago

Verified against the source API 2026-10-28 11:30 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

wso2 / api_control_plane ≥4.5.0 <4.5.0.56, ≥4.6.0 <4.6.0.20

wso2 / api_manager ≥3.1.0 <3.1.0.320, ≥3.2.0 <3.2.0.413, ≥3.2.1 <3.2.1.90, ≥4.0.0 <4.0.0.334, ≥4.1.0 <4.1.0.255, ≥4.2.0 <4.2.0.195

wso2 / identity_server ≥5.10.0 <5.10.0.338, ≥5.11.0 <5.11.0.395, ≥6.0.0 <6.0.0.229, ≥6.1.0 <6.1.0.208

wso2 / identity_server_as_key_manager ≥5.10.0 <5.10.0.338

wso2 / open_banking_am ≥2.0.0 <2.0.0.369

wso2 / open_banking_iam ≥2.0.0 <2.0.0.389

wso2 / traffic_manager ≥4.5.0 <4.5.0.54, ≥4.6.0 <4.6.0.19

wso2 / universal_gateway ≥4.5.0 <4.5.0.55, ≥4.6.0 <4.6.0.19

Weakness classification (CWE)

CWE-613

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-2753/

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/W... ed10eef1-636d-4fbe-9993-6890dfa878f8

Data sources

NVD CVE API 2.0 — fetched 2026-10-28 11:30 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2024-8995

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs