CVE-2024-6832
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The account locking mechanism fails when secondary user stores are inaccessible, allowing repeated authentication attempts without lockout. This leaves users in accessible stores vulnerable to brute force attacks.
Risk Assessment
Users in accessible stores are exposed to brute force attacks, potentially leading to account compromise.
Recommendation
Ensure account locking works consistently even with partial user store unavailability, and consider additional protections like login attempt limits.
Other vulnerabilities in WSO2 Identity Server
See all- CVE-2016-4312High
The XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause denial of service, conduct SSRF attacks, or have unspecified other impacts via a crafted XACML request.
- CVE-2016-4311High
CVE-2016-4311 is a CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 that allows remote attackers to hijack the authentication of privileged users for requests processing XACML requests.
- CVE-2025-14779Low
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation can result in unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and denial-of-service.
- CVE-2025-13736Low
When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage.
- CVE-2025-12627Low
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization, resulting in continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability.
- CVE-2024-8995Medium
Unused authorization codes issued to deleted users are not properly invalidated or removed, allowing potential reuse. An attacker with the code and client credentials can obtain access tokens on behalf of deleted users, leading to unauthorized access.
- CVE-2024-10302Medium
The user self-signup flow in multiple WSO2 products fails to validate user-supplied input, allowing unvalidated data into user claims used by downstream processes. This can lead to various attacks like content manipulation, redirection, and data exposure.
Original NVD description (English source)
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.