CVE-2025-1397

MediumCVSS 4.8/10Last modified Nov 5, 2026

Description

When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.

A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
WSO2WSO2 Universal Gateway>= 4.5.0, < 4.5.0.10
WSO2WSO2 Traffic Manager>= 4.5.0, < 4.5.0.10
WSO2WSO2 API Manager>= 3.1.0, < 3.1.0.321; >= 3.2.0, < 3.2.0.414; >= 3.2.1, < 3.2.1.50; >= 4.0.0, < 4.0.0.335; >= 4.1.0, < 4.1.0.211; >= 4.2.0, < 4.2.0.150; >= 4.3.0, < 4.3.0.63; >= 4.4.0, < 4.4.0.26; >= 4.5.0, < 4.5.0.10
WSO2WSO2 API Control Plane>= 4.5.0, < 4.5.0.11
WSO2WSO2 Identity Server>= 5.10.0, < 5.10.0.346; >= 5.11.0, < 5.11.0.396; >= 6.0.0, < 6.0.0.232; >= 6.1.0, < 6.1.0.224; >= 7.0.0, < 7.0.0.93
WSO2WSO2 Open Banking AM>= 2.0.0, < 2.0.0.370
WSO2WSO2 Open Banking IAM>= 2.0.0, < 2.0.0.390
WSO2WSO2 Identity Server as Key Manager>= 5.10.0, < 5.10.0.339
WSO2WSO2 Carbon OAuth>= 6.4.2, < 6.4.2.155; >= 6.4.111, < 6.4.111.134; >= 6.4.176, < 6.4.176.25; >= 6.4.180, < 6.4.180.11; >= 6.8.0, < 6.8.0.49; >= 6.9.6, < 6.9.6.22; >= 6.11.21, < 6.11.21.75; >= 6.13.16, < 6.13.16.15; >= 6.13.19, < 6.13.19.9; >= 6.13.27, < 6.13.27.2; >= 7.0.26, < 7.0.26.58
WSO2JWT Grant Type For OAuth2>= 1.0.26, < 1.0.26.6; >= 1.0.26, < 1.0.26.7; >= 1.0.31, < 1.0.31.3; >= 1.1.0, < 1.1.0.2; >= 2.0.4, < 2.0.4.3; >= 2.1.1, < 2.1.1.2; >= 2.2.0, < 2.2.0.3; >= 2.2.4, < 2.2.4.1; >= 2.3.1, < 2.3.1.4

References

Timeline

Published
Nov 3, 2026
Last modified
Nov 5, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-139708.0OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an CVE-2025-139714.4The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to,CVE-2025-139724.9The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versionCVE-2025-139735.3The StickEasy Protected Contact Form plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and incluCVE-2025-139744.4The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all verCVE-2025-139754.4The Contact Form 7 with ChatWork plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_token' and 'roomid' settingsCVE-2025-139776.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site ScriptingCVE-2025-139784.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 thCVE-2025-139795.4Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.CVE-2025-13983.3Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bCVE-2025-139805.3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.ThiCVE-2025-139814.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) al
CVE-2025-1397: Medium severity, CVSS 4.8 | Vulnix