CVE-2024-6832
Received Received - Intake

Account Lockout Bypass in User Store System

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WSO2 LLC

Description
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2024-6832
EUVD
EUVD-2024-55707

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
wso2 api_control_plane *
wso2 api_manager *
wso2 enterprise_integrator *
wso2 identity_server *
wso2 open_banking_am *
wso2 open_banking_iam *
wso2 traffic_manager *
wso2 universal_gateway *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2024-6832 is a flaw in WSO2 products where the account locking mechanism fails to activate if secondary user stores are unreachable. This means even after multiple failed login attempts, accounts in accessible stores won't lock, leaving them open to brute force attacks.

Detection Guidance

Check WSO2 product logs for repeated failed authentication attempts without account lockout triggers. Monitor for unusual authentication patterns in active user stores. Review system logs for errors related to inaccessible secondary user stores during authentication attempts.

Impact Analysis

Attackers can repeatedly try invalid passwords against user accounts without triggering account lockouts. This increases the risk of unauthorized access through brute force methods, especially for accounts in user stores that are accessible.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA. Organizations may fail compliance audits if they cannot ensure adequate protection against brute force attacks due to this flaw.

Mitigation Strategies

Apply fixes provided by WSO2 for affected products. If fixes are unavailable, migrate to the latest unaffected versions. As a temporary workaround, disable account lockout features until permanent fixes are implemented.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-6832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart