CVE-2024-5617: Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

DescriptionCVE.org

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.

• WSO2 · WSO2 API Managerfrom 4.0.0 before 4.0.0.298; from 4.2.0 before 4.2.0.95; from 4.3.0 before 4.3.0.13
• WSO2 · WSO2 Identity Serverfrom 5.11.0 before 5.11.0.348; from 6.0.0 before 6.0.0.194; from 6.1.0 before 6.1.0.162; from 7.0.0 before 7.0.0.33
• WSO2 · WSO2 Carbon Identity Managementfrom 5.18.187 before 5.18.187.259; from 5.23.8 before 5.23.8.180; from 5.24.8 before 5.24.8.5; from 5.25.92 before 5.25.92.84; from 5.25.705 before 5.25.705.5; from 7.0.78 before 7.0.78.19
• WSO2 · WSO2 Carbon User Manager Kernelfrom 4.6.1 before 4.6.1.114; from 4.7.1 before 4.7.1.53; from 4.8.1 before 4.8.1.16; from 4.9.0 before 4.9.0.58; from 4.9.26 before 4.9.26.7; from 4.10.9 before 4.10.9.17

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Improper Control of Interaction Frequency · Input Validation and Logic

Vendor

WSO2

Published

November 2026

Band

Unlikely (under 1%), November 2026

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Weakness CWE-799cwe.mitre.org
• Vendor advisorysecurity.docs.wso2.com