CVE-2024-8995: OAuth Authorization Bypass Vulnerability

CVE-2024-8995 Overview

CVE-2024-8995 affects WSO2 products where unused OAuth 2.0 authorization codes issued to deleted users are not properly invalidated. The system retains these codes after user deletion, allowing them to persist beyond their intended lifecycle. An attacker holding both a valid authorization code and the associated client credentials (client ID and client secret) can exchange the code for access tokens on behalf of deleted users. This results in unauthorized access to resources within the scopes originally granted to the compromised authorization code [CWE-613].

Critical Impact
Attackers with authorization codes and client credentials can obtain access tokens for deleted user accounts, enabling unauthorized access to sensitive resources.

Affected Products

WSO2 products referenced in WSO2 Security Advisory WSO2-2024-2753
OAuth 2.0 authorization endpoints exposed by affected WSO2 deployments
Downstream applications relying on WSO2 for identity federation

Discovery Timeline

2026-08-06 - CVE-2024-8995 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2024-8995

Vulnerability Analysis

The vulnerability stems from insufficient session expiration handling in the OAuth 2.0 authorization code flow [CWE-613]. When an administrator deletes a user account, any authorization codes previously issued to that user remain valid in the authorization server's storage. The token endpoint accepts these codes and issues access tokens without validating that the associated user still exists.

Authorization codes are short-lived credentials that clients exchange at the token endpoint for access tokens. The specification expects the authorization server to bind codes to a live subject and invalidate them when the subject is removed. The affected implementation skips this invalidation step, leaving orphaned codes in a redeemable state.

Exploitation requires an attacker to already possess valid client credentials and an unused authorization code, which limits practical exploitation to insiders, compromised OAuth clients, or attackers who have previously captured codes.

Root Cause

The root cause is missing referential cleanup between the user store and the OAuth authorization code store. User deletion operations do not cascade to invalidate outstanding authorization artifacts tied to that user identity, violating expected session lifecycle guarantees.

Attack Vector

The attack occurs over the network against the OAuth 2.0 token endpoint. An attacker submits a captured authorization code along with the corresponding client ID and client secret. The authorization server validates the code and client credentials but omits a check for the underlying user's existence, returning an access token bound to the deleted identity.

The vulnerability manifests in the authorization code redemption path. Refer to the WSO2 Security Advisory WSO2-2024-2753 for vendor-provided technical details.

Detection Methods for CVE-2024-8995

Indicators of Compromise

Successful token endpoint responses (/oauth2/token) referencing user identifiers that no longer exist in the user store
Access token issuance events with grant_type=authorization_code for subjects flagged as deleted
Unusual reuse of client credentials from applications that had not been active before user deletion events

Detection Strategies

Correlate user deletion events with subsequent token issuance events referencing the same subject identifier
Alert on OAuth token exchanges where the resolved user account is missing or in a soft-deleted state
Baseline expected authorization code redemption latency and flag codes redeemed long after issuance

Monitoring Recommendations

Enable verbose OAuth audit logging on WSO2 Identity Server and forward to a centralized analytics platform
Track AuthorizationCodeGrantHandler events and cross-reference against user provisioning logs
Review API gateway access logs for tokens issued to non-existent principals

How to Mitigate CVE-2024-8995

Immediate Actions Required

Apply the fixes referenced in WSO2 Security Advisory WSO2-2024-2753 to affected WSO2 deployments
Rotate OAuth client secrets for applications that may have exposed credentials
Purge outstanding authorization codes associated with recently deleted users from the identity store

Patch Information

WSO2 has published remediation guidance in advisory WSO2-2024-2753. Consult the WSO2 Security Advisory WSO2-2024-2753 for supported product versions, patch bundles, and upgrade paths.

Workarounds

Reduce the authorization code lifetime in the OAuth configuration to minimize the window of exposure
Implement a scheduled job to invalidate authorization codes tied to deleted or disabled user accounts
Restrict access to the token endpoint using network segmentation and mutual TLS where feasible

bash

# Configuration example: shorten authorization code validity in WSO2 identity.xml
# <OAuth>
#   <AuthorizationCodeDefaultValidityPeriod>60</AuthorizationCodeDefaultValidityPeriod>
# </OAuth>