CVE-2025-13173 | WSO2 API Control Plane Token Binding session expiration

October 19, 2026 Yanac

A vulnerability classified as critical has been found in WSO2 API Control Plane, API Manager, API Control Plane, Carbon OAuth, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager and Universal Gateway. This affects an unknown function of the component Token Binding. Performing a manipulation results in session expiration.

This vulnerability was named CVE-2025-13173. The attack may be initiated remotely. There is no available exploit.VulDB Recent EntriesRead More