CVE-2024-6832

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

State: Published
Severity: 5.9 Medium
Published: Aug 6, 2026
Updated: Aug 6, 2026
Reserved: Jul 17, 2024

Description

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.

When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	WSO2

Weaknesses

CWE-693 Protection Mechanism Failure

Affected Products

Product	Versions
WSO2 Enterprise IntegratorWSO2	before 6.6.0Unknown 6.6.0 to before 6.6.0.229Affected
WSO2 API Control PlaneWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.40Affected 4.6.0 to before 4.6.0.4Affected 4.6.0 to before 4.6.0.5Affected
WSO2 Traffic ManagerWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.38Affected 4.6.0 to before 4.6.0.4Affected 4.6.0 to before 4.6.0.5Affected
WSO2 Universal GatewayWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.38Affected 4.6.0 to before 4.6.0.4Affected 4.6.0 to before 4.6.0.5Affected
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.296Affected 3.2.0 to before 3.2.0.386Affected 3.2.0 to before 3.2.0.455Affected 3.2.1 to before 3.2.1.74Affected 4.1.0 to before 4.1.0.238Affected 4.2.0 to before 4.2.0.179Affected 4.3.0 to before 4.3.0.91Affected 4.4.0 to before 4.4.0.55Affected 4.5.0 to before 4.5.0.39Affected 4.6.0 to before 4.6.0.4Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.320Affected 5.11.0 to before 5.11.0.427Affected 6.0.0 to before 6.0.0.254Affected 6.1.0 to before 6.1.0.195Affected 7.0.0 to before 7.0.0.82Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.314Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.366Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.345Affected
WSO2 Carbon User Manager KernelWSO2	4.5.0 to before 4.5.0.7Affected 4.5.3 to before 4.5.3.53Affected 4.6.0 to before 4.6.0.196Affected 4.6.1 to before 4.6.1.163Affected 4.6.1 to before 4.6.1.164Affected 4.6.3 to before 4.6.3.44Affected 4.6.4 to before 4.6.4.25Affected 4.7.1 to before 4.7.1.77Affected 4.7.1 to before 4.7.1.78Affected 4.8.1 to before 4.8.1.46Affected 4.9.26 to before 4.9.26.33Affected 4.9.27 to before 4.9.27.19Affected 4.9.28 to before 4.9.28.21Affected 4.9.33 to before 4.9.33.4Affected 4.10.9 to before 4.10.9.49Affected x and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3352/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.