IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

ISVA 11.0.1 IF1 : after upgrading, refresh tokens are not being invalidated anymore after being used

  • 1.  ISVA 11.0.1 IF1 : after upgrading, refresh tokens are not being invalidated anymore after being used

    Posted 12/08/25 10:07 AM

    Hello,

    We have recently upgraded our UAT ISVA cluster to the latest update (11.0.1 IF1) and thanks to an internal pen-test, we have identified that Refresh tokens are not invalidated anymore after being used.

    I'm able to call the /token endpoint with the same refresh_token as much as I want, with each call generating a new pair of AT/RT/ID_TOKENS.

    -=> Has anyone already noticed this critical change in behavior ? 

    As we are using an OIDC policy where we have not enabled the "Do not rotate refresh token" and "Enable multiple refresh tokens for fault tolerance" this seems more like a critical bug than a desired behavior change.

    I tested the exact same calls on our production environment (still in 11.0.0) and the refresh tokens are correctly discarded after their first use.

    If someone can confirm this, it will be important to advertise that this update (11.0.1 or the IF1) should not go in production for anyone using OIDC/OAuth policies.



    ------------------------------
    André Leruitte
    Security Architect
    POST Luxembourg
    Luxembourg
    ------------------------------


  • 2.  RE: ISVA 11.0.1 IF1 : after upgrading, refresh tokens are not being invalidated anymore after being used

    Posted 12/09/25 02:55 AM

    Hello André,

    we tested it and experience the same result, so we can confirm this is a critical bug.

    Test curl commands and results:

    1. Authentication with PKI
    curl --ssl-auto-client-cert -v -k -i -c cookies.txt -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -X POST https://my.domain/pkmslogin.form

    2. get Authorization Code
    curl -v -k -i -b cookies.txt -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -X POST "https://my.domain/mga/sps/oauth/oauth20/authorize?client_id=test&response_type=code&scope=openid&nonce=noncess&state=state&redirect_uri=https://dummy-test

    3. get Access Token + Refresh Token + id_token
    curl -v -k -i -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -d "client_id=test&client_secret=secret&grant_type=authorization_code&code=PqWXvnvvCqYE50C8vowfhmMrsYv4Up&redirect_uri=https://dummy-test" https://my.domain/mga/sps/oauth/oauth20/token

    {"access_token":"oiCt5aQSbHJhRMV1l5S7","refresh_token":"QlkGusKQwHYP2kM91h4MA3zqUrZA2lRqVoQK9Kei","scope":"openid","id_token":"eyJr...

    4. Check Refresh token lifetime:
    curl -k --data "client_id=test&client_secret=secret&username=myuser&token=QlkGusKQwHYP2kM91h4MA3zqUrZA2lRqVoQK9Kei" https://my.domain/mga/sps/oauth/oauth20/introspect
    {"sub":"myuser","scope":"openid","active":true,"token_type":"refresh_token","exp":1765302190,"iat":1765265507,"client_id":"test","username":"myuser"}

    5. Refresh token
    curl -i -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=refresh_token&refresh_token=QlkGusKQwHYP2kM91h4MA3zqUrZA2lRqVoQK9Kei&client_id=test&client_secret=secret" https://my.domain/mga/sps/oauth/oauth20/token
    {"access_token":"kGtL2DlS81zEM19EYmxC","refresh_token":"HPv03xGeNw2OHqjnSO8q1wkMJD1OVCwsTfo3tS3M","scope":"openid","id_token":"eyJraWQ...

    6.A Check Refresh token lifetime:

    curl -k --data "client_id=test&client_secret=secret&username=myuser&token=QlkGusKQwHYP2kM91h4MA3zqUrZA2lRqVoQK9Kei" https://my.domain/mga/sps/oauth/oauth20/introspect
    {"sub":"myuser","scope":"openid","active":true,"token_type":"refresh_token","exp":1765302190,"iat":1765265507,"client_id":"test","username":"myuser"}

    6.B Check Refresh token lifetime:
    curl -k --data "client_id=test&client_secret=secret&username=myuser&token=HPv03xGeNw2OHqjnSO8q1wkMJD1OVCwsTfo3tS3M" https://my.domain/mga/sps/oauth/oauth20/introspect
    {"sub":"myuser","scope":"openid","active":true,"token_type":"refresh_token","exp":1765302190,"iat":1765265625,"client_id":"test","username":"myuser"}



    ------------------------------
    Gyula Domonkos
    ------------------------------



  • 3.  RE: ISVA 11.0.1 IF1 : after upgrading, refresh tokens are not being invalidated anymore after being used

    Posted 12/09/25 03:04 AM

    Hi Gyula,

    Thanks for your confirmation and the details on how you reproduced the issue.

    I opened case TS020945688 with IBM support this morning to ask if this is already known and if a fix already exists. I will keep this thread updated if I get any relevant information.



    ------------------------------
    André Leruitte
    Security Architect
    POST Luxembourg
    Luxembourg
    ------------------------------

    Original Message


Related Content