PatchTheCVECVE-2024-9517: The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access to
CVE-2024-9517 is a medium-severity flaw (CVSS 4.9) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of b
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-613 |
| Published | 2026-11-02 |
| Last modified | 2026-11-02 |
Last updated 2026-11-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: CVE-2024-9517 2026-11-02
- Vulners Bulletins: CVE-2024-9517 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts 2026-11-02
- Vulners Bulletins: CVE-2024-9517 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts 2026-11-02
- VulDB Recent Entries: CVE-2024-9517 | WSO2 API Control Plane improper authorization 2026-11-02
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-9517?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2024-9517 being exploited?
CVE-2024-9517 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-9517 affect?
CVE-2024-9517 affects affected software. Severity is medium (CVSS 4.9). The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the us
How urgent is CVE-2024-9517?
Priority 17/100. No elevated risk signals yet.