WSO2 Identity Server skips scope checks for client credentials grant
Company login servers can let unauthorized apps take over admin powers.
Summary
With authorize_all_scopes enabled, WSO2 Identity Server and the Identity Application Management Component let applications obtained through the client credentials grant receive all API scopes without explicit authorization. Unprivileged clients can then perform administrative actions or reach confidential data.
Affected when
- authorize_all_scopes set to true in deployment.toml
What to do
Update WSO2 Identity Server 7.1.0 to update level 32 or higher, and 7.0.0 to update level 125 or higher. If you cannot update, migrate to the latest unaffected version. After updating, add authorize_internal_scopes = false under [oauth] in deployment.toml. If authorize_all_scopes is absent or false, you are not affected.
Update to at least the version for your product:
- WSO2 Identity Server 7.1.0 32 or later
- WSO2 Identity Server 7.0.0 125 or later
Products and platforms
CVE IDs
Sources
- Advisory: security.docs.wso2.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen