CVE-2024-8122
Deferred Deferred - Pending Action

SMS OTP Brute Force in WSO2 Identity Server

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: WSO2 LLC

Description
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP. The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2024-8122
EUVD
EUVD-2024-55782

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
WSO2 WSO2 Identity Server 5.11.0
WSO2 WSO2 Identity Server 6.0.0
WSO2 WSO2 Identity Server 6.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WSO2 Identity Server allows SMS One-Time Passwords (OTPs) used for multi-factor authentication to remain valid indefinitely. Attackers can exploit this by repeatedly guessing the OTP over an unlimited timeframe, potentially bypassing MFA and gaining unauthorized access to user accounts.

Detection Guidance

Detecting this vulnerability requires checking if SMS OTPs in WSO2 Identity Server have no expiry time set. Review server logs for repeated OTP validation attempts or unusual MFA bypass activities. No specific commands are provided in the context.

Impact Analysis

If affected, your account could be compromised through brute force attacks on the OTP. This may lead to unauthorized access, data breaches, or loss of control over your account and sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication and protection of user data, such as GDPR's security principles or HIPAA's access controls. Failure to address it may result in regulatory penalties or loss of certification.

Mitigation Strategies

Configure a default expiry time for SMS OTPs in WSO2 Identity Server settings. Limit OTP attempts to prevent brute force attacks. Monitor and audit MFA logs for suspicious activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-8122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart