# CVE-2024-5617: Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.

This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.

## Remediation

- fix: Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution (source: CNA: WSO2)

## Affected products and versions

- WSO2 / WSO2 API Manager: ≥ 0; < 4.0.0 (unknown, custom); ≥ 4.0.0; < 4.0.0.298 (affected, custom); ≥ 4.2.0; < 4.2.0.95 (affected, custom); ≥ 4.3.0; < 4.3.0.13 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Identity Server: ≥ 0; < 5.11.0 (unknown, custom); ≥ 5.11.0; < 5.11.0.348 (affected, custom); ≥ 6.0.0; < 6.0.0.194 (affected, custom); ≥ 6.1.0; < 6.1.0.162 (affected, custom); ≥ 7.0.0; < 7.0.0.33 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Carbon Identity Management (org.wso2.carbon.identity.mgt): ≥ 5.18.187; < 5.18.187.259 (affected, custom); ≥ 5.23.8; < 5.23.8.180 (affected, custom); ≥ 5.24.8; < 5.24.8.5 (affected, custom); ≥ 5.25.92; < 5.25.92.84 (affected, custom); ≥ 5.25.705; < 5.25.705.5 (affected, custom); ≥ 7.0.78; < 7.0.78.19 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Carbon User Manager Kernel (org.wso2.carbon:org.wso2.carbon.user.core): ≥ 4.6.1; < 4.6.1.114 (affected, custom); ≥ 4.7.1; < 4.7.1.53 (affected, custom); ≥ 4.8.1; < 4.8.1.16 (affected, custom); ≥ 4.9.0; < 4.9.0.58 (affected, custom); ≥ 4.9.26; < 4.9.26.7 (affected, custom); ≥ 4.10.9; < 4.10.9.17 (affected, custom). Source: CNA: WSO2

## Severity and prioritization

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N; source: CNA: WSO2

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N; source: NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-799

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/ (CNA: WSO2; vendor-advisory)

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/ (ed10eef1-636d-4fbe-9993-6890dfa878f8)

## Provenance

- CNA: WSO2: https://www.cve.org/CVERecord?id=CVE-2024-5617; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5617; retrieved 2026-11-03; source updated 2026-11-02

Revision: f7e72b5757e961d4ae57a933ed55ea4de9e7445e27cee26cd9f5c2c75bed03ac

Canonical: https://y2.dev/cve/CVE-2024-5617

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.