CVE-2024-5563
Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.
| CWE | CWE-306 |
| Vendor | wso2 |
| Product | wso2 identity server |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 identity server
Be the first to know when new medium vulnerabilities affecting wso2 wso2 identity server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WSO2 / WSO2 Identity Server
7.0.0 < 7.0.0.37