The RemoteUserStoreManagerService in multiple WSO2 products fails to enforce the password history validation rule when the feature is enabled. This oversight lets an attacker repeatedly submit password change requests for a target account without the system imposing its usual restrictions. Because each attempt is processed, an attacker can perform a brute‑force attack against the account’s password, potentially discovering the correct password and gaining full impersonation of that user. The risk is proportional to the target password’s complexity; weaker passwords increase the likelihood of compromise.

The vulnerability affects WSO2 API Manager, WSO2 Carbon User Manager Kernel, WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. No specific vulnerable versions are listed, which implies all versions that support password history validation are impacted.

The CVSS base score of 4.8 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote via the exposed RemoteUserStoreManagerService, requiring network access to the WSO2 instance. Successful exploitation requires that the password history feature is enabled; the attacker then sends repeated password change requests and narrows down the correct password as it is guessed.