Authentication Bypass in WSO2 Identity Server by WSO2
CVE-2024-5563

4.8MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server
Vendor
CVE Published:
21 October 2026

What is CVE-2024-5563?

A flaw in the WSO2 Identity Server allows attackers to bypass reCaptcha protection on certain authentication flows. Despite the reCaptcha option being enabled, its incomplete implementation means that brute force attacks can be conducted. As a result, attackers may systematically guess various credential combinations, leading to unauthorized access to user accounts and sensitive information.

Affected Version(s)

WSO2 Identity Server 7.0.0 < 7.0.0.37

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.