CVE-2024-5563

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

State: Published
Severity: 4.8 Medium
Published: Oct 21, 2026
Updated: Oct 30, 2026
Reserved: May 31, 2024

Description

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	WSO2

Weaknesses

CWE-306 πιστη του client στο "login""

Affected Products

Product	Versions
WSO2 Identity ServerWSO2	before 7.0.0Unknown 7.0.0 to before 7.0.0.37Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.