CVE-2024-0391

The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server::::::::

Configuration 2 (hide)

cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*

History

27 May 2026, 19:54

Type	Values Removed	Values Added
CPE		cpe:2.3:a:wso2:identity_server:::::::: cpe:2.3:a:wso2:identity_server_as_key_manager:::::::: cpe:2.3:a:wso2:open_banking_iam::::::::
References	~~() https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/ -~~	() https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/ - Vendor Advisory
First Time		Wso2 open Banking Iam Wso2 identity Server Wso2 Wso2 identity Server As Key Manager

11 May 2026, 10:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-11 10:16

Updated : 2026-05-27 19:54

NVD link : CVE-2024-0391

Mitre link : CVE-2024-0391

CVE.ORG link : CVE-2024-0391

JSON object : View

Products Affected

wso2

open_banking_iam
identity_server_as_key_manager
identity_server

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2024-0391", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-05-11T10:16:11.593", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts.\n\nThe discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences."}], "lastModified": "2026-05-27T19:54:32.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "760849A7-CF72-4CF1-BEC6-8E47AC5ADE29", "versionEndExcluding": "5.10.0.379", "versionStartIncluding": "5.10.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4F45B46-613A-4DE3-B6BB-A30D635A860E", "versionEndExcluding": "5.11.0.426", "versionStartIncluding": "5.11.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AE280EA-5F20-4D83-A72A-07526AF65067", "versionEndExcluding": "6.0.0.253", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A34A0057-4EE7-4D20-A343-09592A508849", "versionEndExcluding": "6.1.0.254", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "110F5D8D-32E8-4E7B-8925-D04781FC8B2D", "versionEndExcluding": "7.0.0.131", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAEE7A87-67DA-4266-B0D0-7E4FD5475B4F", "versionEndExcluding": "5.10.267", "versionStartIncluding": "5.10.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D551292-3788-4775-B02A-1C8CA02AFECC", "versionEndExcluding": "2.0.0.318", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}