The vulnerability is an incomplete implementation of reCaptcha in WSO2 Identity Server. When the reCaptcha option is enabled, certain authentication flows still skip the captcha check, leaving the system exposed to brute force attacks. Attackers can systematically try credential combinations without any rate limiting or detection, potentially gaining unauthorized access to user accounts and sensitive data.

WSO2 Identity Server is the product affected by this issue. No specific version information is listed in the advisory, so all deployments of this product that rely on reCaptcha for protecting authentication flows may be impacted.

The CVSS score of 4.8 indicates medium severity. Although an EPSS score is not available, the risk is still considered moderate because brute force requires many attempts but can succeed if the victim’s credentials are weak. The vulnerability is not listed in CISA’s KEV catalog, but the attack vector is clear: any authentication flow that omits reCaptcha can be targeted for brute‑force exploitation.