Vulnerability · Published Nov 2, 2026 · Assigned by WSO2
CVE-2024-5617Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
Medium 4.8
In plain English
A medium-severity security flaw in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 4.0.0 – before 4.0.0.2984.2.0 – before 4.2.0.954.3.0 – before 4.3.0.13 |
| WSO2 | WSO2 Identity Server | 5.11.0 – before 5.11.0.3486.0.0 – before 6.0.0.1946.1.0 – before 6.1.0.1627.0.0 – before 7.0.0.33 |
| WSO2 | WSO2 Carbon Identity Management | 5.18.187 – before 5.18.187.2595.23.8 – before 5.23.8.1805.24.8 – before 5.24.8.55.25.92 – before 5.25.92.845.25.705 – before 5.25.705.57.0.78 – before 7.0.78.19 |
| WSO2 | WSO2 Carbon User Manager Kernel | 4.6.1 – before 4.6.1.1144.7.1 – before 4.7.1.534.8.1 – before 4.8.1.164.9.0 – before 4.9.0.584.9.26 – before 4.9.26.74.10.9 – before 4.10.9.17 |
Weakness: CWE-799 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N