Account Lockout Bypass in WSO2 Product Affecting User Authentication

CVE-2024-5617

What is CVE-2024-5617?

A flaw in WSO2 Identity Server's account lock feature allows attackers to exploit the system when multiple users share identical usernames across primary and secondary user stores. Instead of applying lockout conditions uniformly, the mechanism only affects the secondary store, leaving the primary user store vulnerable. This oversight permits unauthorized password attempts, enabling potential brute force attacks that can compromise sensitive user accounts and information.

References