CVE-2024-5617 - Vulnerability Details

- Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

Description

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.

This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.

Published: 2026-11-02

Score: 4.8 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 4.0.0
`4.0.0`	affected	< 4.0.0.298
`4.2.0`	affected	< 4.2.0.95
`4.3.0`	affected	< 4.3.0.13

WSO2

WSO2 Identity Server

unaffected

Version	Status	Constraints
`0`	unknown	< 5.11.0
`5.11.0`	affected	< 5.11.0.348
`6.0.0`	affected	< 6.0.0.194
`6.1.0`	affected	< 6.1.0.162
`7.0.0`	affected	< 7.0.0.33

WSO2

WSO2 Carbon Identity Management

unknown

Version	Status	Constraints
`5.18.187`	affected	< 5.18.187.259
`5.23.8`	affected	< 5.23.8.180
`5.24.8`	affected	< 5.24.8.5
`5.25.92`	affected	< 5.25.92.84
`5.25.705`	affected	< 5.25.705.5
`7.0.78`	affected	< 7.0.78.19

WSO2

WSO2 Carbon User Manager Kernel

unknown

Version	Status	Constraints
`4.6.1`	affected	< 4.6.1.114
`4.7.1`	affected	< 4.7.1.53
`4.8.1`	affected	< 4.8.1.16
`4.9.0`	affected	< 4.9.0.58
`4.9.26`	affected	< 4.9.26.7
`4.10.9`	affected	< 4.10.9.17

No data.

Vendor Product Confidence Versions

Wso2

Api Manager

100%

Version	Status	Scheme	Platform
`[4.0.0,4.0.0.298)`	affected	generic	—
`[4.2.0,4.2.0.95)`	affected	generic	—
`[4.3.0,4.3.0.13)`	affected	generic	—

Wso2

Identity Server

100%

Version	Status	Scheme	Platform
`[5.11.0,5.11.0.348)`	affected	generic	—
`[6.0.0,6.0.0.194)`	affected	generic	—
`[6.1.0,6.1.0.162)`	affected	generic	—
`[7.0.0,7.0.0.33)`	affected	generic	—

Wso2

Wso2 Api Manager

100%

Version	Status	Scheme	Platform
`[4.0.0,4.0.0.298)`	affected	generic	—
`[4.2.0,4.2.0.95)`	affected	generic	—
`[4.3.0,4.3.0.13)`	affected	generic	—

Wso2

Wso2 Carbon Identity Management

100%

Version	Status	Scheme	Platform
`[5.18.187,5.18.187.259)`	affected	generic	—
`[5.23.8,5.23.8.180)`	affected	generic	—
`[5.24.8,5.24.8.5)`	affected	generic	—
`[5.25.92,5.25.92.84)`	affected	generic	—
`[5.25.705,5.25.705.5)`	affected	generic	—
`[7.0.78,7.0.78.19)`	affected	generic	—

Wso2

Wso2 Carbon User Manager Kernel

100%

Version	Status	Scheme	Platform
`[4.6.1,4.6.1.114)`	affected	generic	—
`[4.7.1,4.7.1.53)`	affected	generic	—
`[4.8.1,4.8.1.16)`	affected	generic	—
`[4.9.0,4.9.0.58)`	affected	generic	—
`[4.9.26,4.9.26.7)`	affected	generic	—
`[4.10.9,4.10.9.17)`	affected	generic	—

Wso2

Wso2 Identity Server

100%

Version	Status	Scheme	Platform
`[5.11.0,5.11.0.348)`	affected	generic	—
`[6.0.0,6.0.0.194)`	affected	generic	—
`[6.1.0,6.1.0.162)`	affected	generic	—
`[7.0.0,7.0.0.33)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/

History

Mon, 02 Nov 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wso2 api Manager Wso2 identity Server
Vendors & Products		Wso2 api Manager Wso2 identity Server

Mon, 02 Nov 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.
Title		Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
First Time appeared		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carbon Identity Management Wso2 wso2 Carbon User Manager Kernel Wso2 wso2 Identity Server
Weaknesses		CWE-799
CPEs		cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_management:::::::: cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carbon Identity Management Wso2 wso2 Carbon User Manager Kernel Wso2 wso2 Identity Server
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

Subscriptions

Wso2 Api Manager Identity Server Wso2 Api Manager Wso2 Carbon Identity Management Wso2 Carbon User Manager Kernel Wso2 Identity Server

MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2026-11-02T05:57:28.711Z

Updated: 2026-11-02T06:13:53.229Z

Reserved: 2024-06-04T06:07:32.224Z

Link: CVE-2024-5617

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-02T06:17:41.933

Modified: 2026-11-02T06:17:41.933

Link: CVE-2024-5617

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-02T09:15:06Z

Weaknesses

CWE-799
Improper Control of Interaction Frequency

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object