All vulnerabilities
CVE-2024-5563

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

WSO2 WSO2 Identity Server
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.0.0.37Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

Text from CVE List

Affected versions 2

  • WSO2 Identity Serverunknown: all versions before 7.0.0CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.37CVE List

References 1