CVE-2025-13173 Auth bypass in WSO2 API Control Plane
Attackers can maintain unauthorized access after logout if session-bound tokens are not revoked, exposing sensitive data in WSO2 products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13173?
CVE-2025-13173 is a medium-severity authentication bypass vulnerability in WSO2 API Control Plane, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Weakness: CWE-613
Which versions are affected by CVE-2025-13173?
How do I fix CVE-2025-13173?
No fix has been published for CVE-2025-13173 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-13173 being exploited?
There is no known exploitation of CVE-2025-13173 in the wild and no public exploit code.
Sources
Also known as GHSA-34m5-cm5w-xf6v.