All vulnerabilities
CVE-2024-7478

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

WSO2 WSO2 API Manager
Open in ThreatlineRecord JSON
CVSS
5.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.1.0.310Also 3.2.0.401, 3.2.1.26 and 20 moreCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

Show all 23 fixed versions
  • 4.3.0.30WSO2 API ManagerCVE List
  • 5.10.0.320WSO2 Identity Server as Key ManagerCVE List
  • 5.10.0.326WSO2 Identity ServerCVE List
  • 6.0.0.214WSO2 Identity ServerCVE List
  • 6.1.0.198WSO2 Identity ServerCVE List
  • 7.0.0.67WSO2 Identity ServerCVE List
  • 2.0.0.371WSO2 Open Banking IAMCVE List
  • 2.0.0.351WSO2 Open Banking AMCVE List
  • 1.4.0.15WSO2 Carborn Identity HandlerCVE List
  • 1.4.0.16WSO2 Carborn Identity HandlerCVE List
  • 1.4.11.14WSO2 Carborn Identity HandlerCVE List
  • 1.4.37.1WSO2 Carborn Identity HandlerCVE List
  • 1.6.1.5WSO2 Carborn Identity HandlerCVE List
  • 1.7.1.1WSO2 Carborn Identity HandlerCVE List
  • 1.8.6.5WSO2 Carborn Identity HandlerCVE List
  • 1.8.14.1WSO2 Carborn Identity HandlerCVE List
  • 1.9.2.4WSO2 Carborn Identity HandlerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.

The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.

Text from CVE List

Affected versions 28

  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.310CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.401CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.26CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.318CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.180CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.119CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.30CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.320CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.326CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.214CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.198CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.67CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.371CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.351CVE List
  • WSO2 Carborn Identity Handleraffected: 1.4.0 before 1.4.0.15CVE List
  • WSO2 Carborn Identity Handleraffected: 1.4.0 before 1.4.0.16CVE List
  • WSO2 Carborn Identity Handleraffected: 1.4.11 before 1.4.11.14CVE List
  • WSO2 Carborn Identity Handleraffected: 1.4.37 before 1.4.37.1CVE List
  • WSO2 Carborn Identity Handleraffected: 1.6.1 before 1.6.1.5CVE List
  • WSO2 Carborn Identity Handleraffected: 1.7.1 before 1.7.1.1CVE List
  • WSO2 Carborn Identity Handleraffected: 1.8.6 before 1.8.6.5CVE List
  • WSO2 Carborn Identity Handleraffected: 1.8.14 before 1.8.14.1CVE List
  • WSO2 Carborn Identity Handleraffected: 1.9.2 before 1.9.2.4CVE List

References 1