Description
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.
When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.
When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 API Control Plane | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Traffic Manager | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Universal Gateway | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 API Manager | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Identity Server | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Identity Server as Key Manager | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Open Banking IAM | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Open Banking AM | unaffected |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Carbon User Manager Kernel | unknown |
|
No data.
No data.
No data available yet.
Remediation
Vendor Solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3352/#solution
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Thu, 06 Aug 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence. | |
| Title | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | |
| Weaknesses | CWE-693 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2026-08-06T07:32:59.256Z
Reserved: 2024-07-17T11:44:02.821Z
Link: CVE-2024-6832
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-693
Protection Mechanism Failure