CVE-2024-0391

The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::

Configuration 2 (hide)

cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-11 10:16

Updated : 2026-06-17 06:53

NVD link : CVE-2024-0391

Mitre link : CVE-2024-0391

CVE.ORG link : CVE-2024-0391

JSON object : View

Products Affected

wso2

identity_server_as_key_manager
identity_server
open_banking_iam

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2024-0391", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-0391", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T12:45:51.278289Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.379", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.426", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.431", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.253", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.254", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.131", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.318", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.267", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "Email OTP Authenticator", "versions": [{"status": "affected", "version": "1.0.18", "lessThan": "1.0.18.7", "versionType": "custom"}, {"status": "unaffected", "version": "1.0.24", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Authenticator Library For EmailOTP", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.8", "versionType": "custom"}, {"status": "affected", "version": "4.1.4", "lessThan": "4.1.4.9", "versionType": "custom"}, {"status": "unaffected", "version": "4.1.22", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.emailotp:org.wso2.carbon.identity.authenticator.emailotp", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Authenticator Library For EmailOTP", "versions": [{"status": "affected", "version": "3.0.5", "lessThan": "3.0.5.8", "versionType": "custom"}, {"status": "affected", "version": "3.0.24", "lessThan": "3.0.24.6", "versionType": "custom"}, {"status": "affected", "version": "3.0.26", "lessThan": "3.0.26.16", "versionType": "custom"}], "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.emailotp:org.wso2.carbon.extension.identity.authenticator.emailotp.connector", "defaultStatus": "unknown"}]}], "published": "2026-05-11T10:16:11.593", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts.\n\nThe discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences."}], "lastModified": "2026-06-17T06:53:24.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "760849A7-CF72-4CF1-BEC6-8E47AC5ADE29", "versionEndExcluding": "5.10.0.379", "versionStartIncluding": "5.10.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4F45B46-613A-4DE3-B6BB-A30D635A860E", "versionEndExcluding": "5.11.0.426", "versionStartIncluding": "5.11.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AE280EA-5F20-4D83-A72A-07526AF65067", "versionEndExcluding": "6.0.0.253", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A34A0057-4EE7-4D20-A343-09592A508849", "versionEndExcluding": "6.1.0.254", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "110F5D8D-32E8-4E7B-8925-D04781FC8B2D", "versionEndExcluding": "7.0.0.131", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAEE7A87-67DA-4266-B0D0-7E4FD5475B4F", "versionEndExcluding": "5.10.267", "versionStartIncluding": "5.10.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D551292-3788-4775-B02A-1C8CA02AFECC", "versionEndExcluding": "2.0.0.318", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}