CVE-2024-5563: Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.
Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
WSO2 Identity Server deployments that have reCAPTCHA enabled may still be exposed if they use one of the affected authentication flows. The provided information does not identify which specific flows are affected.
What does an attacker need to exploit the weakness?
An attacker can remotely attempt repeated credential combinations without prior authentication or user interaction. Exploitation requires a successful brute-force attempt against an account's credentials.
What is the impact of a successful attack?
A successful brute-force attack can provide unauthorized access to user accounts and the sensitive information available through those accounts.