Improper Expiration of SMS OTPs in WSO2 Identity Server
CVE-2024-8122

5.9MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server
Vendor
CVE Published:
8 October 2026

What is CVE-2024-8122?

The WSO2 Identity Server has a significant issue where it does not enforce a default expiration time for SMS One-Time Passwords (OTPs) utilized in multi-factor authentication processes. This design flaw allows SMS OTPs to remain valid indefinitely, granting attackers the potential to execute brute force attacks by repeatedly attempting to guess the correct OTP. The lack of an automatic expiry mechanism for OTPs means that malicious actors have unlimited opportunities to gain access, which could ultimately lead to the bypassing of multi-factor authentication protocols. Such unauthorized access poses a substantial risk to both user accounts and the overall security of the system.

Affected Version(s)

WSO2 Identity Server 5.11.0 < 5.11.0.372

WSO2 Identity Server 6.0.0 < 6.0.0.227

WSO2 Identity Server 6.1.0 < 6.1.0.219

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.