CVE-2024-5563

Deferred Deferred - Pending Action

reCaptcha Bypass in Authentication Flow Allows Brute Force Attacks

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: WSO2 LLC

Description

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2024-5563

EUVD

EUVD-2024-55812

Affected Vendors & Products

Vendor	Product	Version / Range
WSO2	WSO2 Identity Server	7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability occurs because reCaptcha protection is not fully enforced during certain authentication processes, even when the feature is enabled. Attackers can exploit this by attempting brute force attacks to guess credentials and gain unauthorized access to user accounts and sensitive data.

Impact Analysis

If exploited, this vulnerability could allow attackers to bypass authentication protections and gain unauthorized access to user accounts. This may lead to theft of sensitive information or further compromise of systems relying on reCaptcha for security.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if user accounts are compromised.

Mitigation Strategies

Ensure reCaptcha is properly enforced across all authentication flows. Review and update security configurations to prevent brute force attacks. Monitor for unusual login attempts or unauthorized access.

Hi! I’m here to help you understand CVE-2024-5563. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...