---
id: "CVE-2024-2323"
kind: "vulnerability"
aliases: ["CVE-2024-2323"]
title: "RemoteUserStoreManagerService: password change lets attackers brute-force user passwords"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["identity-server", "other", "wso2"]
not_affected_if: ["password-history-disabled"]
published_at: "2026-10-20T08:16:40+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:33:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2323", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# RemoteUserStoreManagerService: password change lets attackers brute-force user passwords

When password history validation is enabled, the RemoteUserStoreManagerService does not limit repeated password change attempts. An attacker can guess a user's password repeatedly and take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-2323

## From the sources

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.

Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_