CVE-2024-7478 - Vulnerability Details

- Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

Description

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.

The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.

Published: 2026-10-21

Score: 5.8 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

When a WSO2 product is configured to use an external user store, the authentication mechanism fails to hide whether a given username is valid. As a result, an attacker who can send repeated authentication attempts can discover which usernames exist, enabling targeted brute‑force attacks, phishing, and other credential‑based compromises that could lead to sensitive data exposure and reputational harm.

Affected Systems

All versions of the listed WSO2 products—WSO2 API Manager, WSO2 Carbon Identity Handler, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM—are affected when they are configured to use an external user store. No specific version numbers are supplied; the issue applies to all impacted configurations.

Risk and Exploitability

The vulnerability carries a medium CVSS score of 5.8, with no EPSS score available and it is not listed in the CISA KEV catalog. The most likely attack vector is remote authentication over the network, requiring the ability to send authentication requests to the affected endpoint. An attacker can iteratively test usernames to build a full list of valid accounts, significantly reducing the effort needed for subsequent credential‑guessing or social‑engineering attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 3.1.0
`3.1.0`	affected	< 3.1.0.310
`3.2.0`	affected	< 3.2.0.401
`3.2.1`	affected	< 3.2.1.26
`4.0.0`	affected	< 4.0.0.318
`4.1.0`	affected	< 4.1.0.180
`4.2.0`	affected	< 4.2.0.119
`4.3.0`	affected	< 4.3.0.30

WSO2

WSO2 Identity Server as Key Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10.0
`5.10.0`	affected	< 5.10.0.320

WSO2

WSO2 Identity Server

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10.0
`5.10.0`	affected	< 5.10.0.326
`6.0.0`	affected	< 6.0.0.214
`6.1.0`	affected	< 6.1.0.198
`7.0.0`	affected	< 7.0.0.67

WSO2

WSO2 Open Banking IAM

unaffected

Version	Status	Constraints
`0`	unknown	< 2.0.0
`2.0.0`	affected	< 2.0.0.371

WSO2

WSO2 Open Banking AM

unaffected

Version	Status	Constraints
`0`	unknown	< 2.0.0
`2.0.0`	affected	< 2.0.0.351

WSO2

WSO2 Carborn Identity Handler

unknown

Version	Status	Constraints
`1.4.0`	affected	< 1.4.0.15
`1.4.0`	affected	< 1.4.0.16
`1.4.11`	affected	< 1.4.11.14
`1.4.37`	affected	< 1.4.37.1
`1.6.1`	affected	< 1.6.1.5
`1.7.1`	affected	< 1.7.1.1
`1.8.6`	affected	< 1.8.6.5
`1.8.14`	affected	< 1.8.14.1
`1.9.2`	affected	< 1.9.2.4

No data.

Vendor Product Confidence Versions

Wso2

Identity Server

100%

Version	Status	Scheme	Platform
`[5.10.0,5.10.0.326)`	affected	generic	—
`[6.0.0,6.0.0.214)`	affected	generic	—
`[6.1.0,6.1.0.198)`	affected	generic	—
`[7.0.0,7.0.0.67)`	affected	generic	—

Wso2

Wso2 Api Manager

100%

Version	Status	Scheme	Platform
`[3.1.0,3.1.0.310)`	affected	generic	—
`[3.2.0,3.2.0.401)`	affected	generic	—
`[3.2.1,3.2.1.26)`	affected	generic	—
`[4.0.0,4.0.0.318)`	affected	generic	—
`[4.1.0,4.1.0.180)`	affected	generic	—
`[4.2.0,4.2.0.119)`	affected	generic	—
`[4.3.0,4.3.0.30)`	affected	generic	—

Wso2

Wso2 Carborn Identity Handler

100%

Version	Status	Scheme	Platform
`[1.4.0,1.4.0.15)`	affected	generic	—
`[1.4.0,1.4.0.16)`	affected	generic	—
`[1.4.11,1.4.11.14)`	affected	generic	—
`[1.4.37,1.4.37.1)`	affected	generic	—
`[1.6.1,1.6.1.5)`	affected	generic	—
`[1.7.1,1.7.1.1)`	affected	generic	—
`[1.8.6,1.8.6.5)`	affected	generic	—
`[1.8.14,1.8.14.1)`	affected	generic	—
`[1.9.2,1.9.2.4)`	affected	generic	—

Wso2

Wso2 Identity Server

100%

Version	Status	Scheme	Platform
`[5.10.0,5.10.0.326)`	affected	generic	—
`[6.0.0,6.0.0.214)`	affected	generic	—
`[6.1.0,6.1.0.198)`	affected	generic	—
`[7.0.0,7.0.0.67)`	affected	generic	—

Wso2

Wso2 Identity Server As Key Manager

100%

Version	Status	Scheme	Platform
`[5.10.0,5.10.0.320)`	affected	generic	—

Wso2

Wso2 Open Banking Am

100%

Version	Status	Scheme	Platform
`[2.0.0,2.0.0.351)`	affected	generic	—

Wso2

Wso2 Open Banking Iam

100%

Version	Status	Scheme	Platform
`[2.0.0,2.0.0.371)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution

OpenCVE Recommended Actions

Implement the fixes provided in the WSO2 security advisory by following the instructions at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution.
If an immediate patch is not possible, block or rate‑limit authentication attempts against external user stores to prevent brute‑force enumeration.
Change the authentication error messages to a generic response that does not reveal username validity, thereby mitigating enumeration.

Generated by OpenCVE AI on October 22, 2026 at 00:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/

History

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wso2 identity Server
Vendors & Products		Wso2 identity Server

Wed, 21 Oct 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
Title		Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
First Time appeared		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carborn Identity Handler Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam
Weaknesses		CWE-204
CPEs		cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_carborn_identity_handler:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:::::::: cpe:2.3:a:wso2:wso2_open_banking_am:::::::: cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carborn Identity Handler Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}`

Subscriptions

Wso2 Identity Server Wso2 Api Manager Wso2 Carborn Identity Handler Wso2 Identity Server Wso2 Identity Server As Key Manager Wso2 Open Banking Am Wso2 Open Banking Iam

MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2026-10-21T13:49:07.839Z

Updated: 2026-10-21T13:49:07.839Z

Reserved: 2024-08-05T07:38:19.343Z

Link: CVE-2024-7478

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-10-21T14:17:06.147

Modified: 2026-10-21T18:37:59.557

Link: CVE-2024-7478

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-22T01:30:06Z

Weaknesses

CWE-204
Observable Response Discrepancy

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object