{"id":"CVE-2024-5617","kind":"vulnerability","aliases":["CVE-2024-5617"],"related":[],"title":"Account lockout skipped on primary user store when usernames collide","description":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.","summary":"When the same username exists in both a primary and a secondary user store, the account lock only applies to the secondary account. An attacker can keep guessing passwords against the primary account without being locked out.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["account-lockout","identity","infrastructure","user-store"],"not_affected_if":["single-user-store","unique-usernames"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T06:17:41+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","triaged_at":"2026-11-02T06:23:59+00:00","updated_at":"2026-11-02T06:23:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T06:23:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Account lockout skipped on primary user store when usernames collide","impact":"high","summary":"When the same username exists in both a primary and a secondary user store, the account lock only applies to the secondary account. An attacker can keep guessing passwords against the primary account without being locked out.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["identity","user-store","account-lockout"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker brute-forces a primary account password without lockout","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2024-5617; the sources do not name them.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-store","unique-usernames"],"who_is_affected":"Systems that authenticate users against a primary user store and a secondary user store where identical usernames exist in both, with account lockout enabled. Deployments with a single user store or unique usernames across stores are not described as affected. The sources do not name the product or versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":4201,"output_tokens":443,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':12A,15A '-5617':13A,16A 'access':141C 'account':1A,18B,40B,47B,57B,62C,69C,103C,116C,134C,146C,150C 'account-lockout':17B 'allow':107C 'appli':43B,97C 'attack':49B,123C,136C 'attempt':110C,126C,158C 'authent':109C 'brute':121C 'collid':10A 'condit':94C 'continu':108C 'correct':67C 'cve':11A,14A 'differ':127C 'enabl':120C 'enforc':68C 'exist':29B,81C 'fail':65C 'featur':64C 'flaw':119C 'forc':122C 'function':118C 'gain':139C 'guess':52B 'ident':20B,79C 'inform':144C 'infrastructur':21B 'intend':149C 'keep':51B 'lock':41B,60B,63C,93C 'lockout':2A,19B,70C,151C 'login':157C 'mechan':152C 'occur':90C 'password':53B,128C 'potenti':138C 'prevent':155C 'primari':5A,33B,56B,73C,84C,113C,131C 'repeat':156C 'scenario':106C 'secondari':36B,46B,86C,100C 'sensit':143C 'skip':3A 'store':7A,24B,38B,75C,88C,102C,115C,133C 'systemat':125C 'unauthor':140C 'user':6A,23B,37B,74C,77C,87C,101C,114C,132C 'user-stor':22B 'usernam':9A,28B,80C 'without':58B","nicknames":[],"mitigations":[],"who_affected":"Systems that authenticate users against a primary user store and a secondary user store where identical usernames exist in both, with account lockout enabled. Deployments with a single user store or unique usernames across stores are not described as affected. The sources do not name the product or versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["accountlockout","identity","infrastructure","medium","userstore"],"first_public_at":"2026-11-02T06:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-5617","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5617","severity":null,"published_at":"2026-11-02T06:17:41+00:00","modified_at":"2026-11-02T06:17:41+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","fetched_at":"2026-11-02T06:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}