CVE-2024-5563

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/

Configurations

No configuration.

History

27 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Debido a una implementación incompleta, reCaptcha no se aplica a ciertos flujos de autenticación aunque la opción de reCaptcha esté habilitada. Esta omisión permite a los atacantes eludir el mecanismo de protección previsto.\n\nLos ataques de fuerza bruta, si tienen éxito, pueden provocar acceso no autorizado a cuentas de usuario e información sensible al intentar sistemáticamente diversas combinaciones de credenciales.

21 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 14:17

Updated : 2026-10-30 17:17

NVD link : CVE-2024-5563

Mitre link : CVE-2024-5563

CVE.ORG link : CVE-2024-5563

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2024-5563", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-5563", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:10:35.405678Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "7.0.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.37", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-21T14:17:05.230", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.\n\nBrute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations."}, {"lang": "es", "value": "Debido a una implementaci\u00f3n incompleta, reCaptcha no se aplica a ciertos flujos de autenticaci\u00f3n aunque la opci\u00f3n de reCaptcha est\u00e9 habilitada. Esta omisi\u00f3n permite a los atacantes eludir el mecanismo de protecci\u00f3n previsto.\\n\\nLos ataques de fuerza bruta, si tienen \u00e9xito, pueden provocar acceso no autorizado a cuentas de usuario e informaci\u00f3n sensible al intentar sistem\u00e1ticamente diversas combinaciones de credenciales."}], "lastModified": "2026-10-30T17:17:09.680", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}