Live › vulnerability › CVE-2024-7478
Go to dashboardWhen a WSO2 product uses an external user store, its login flow does not hide whether a username exists or is valid. An attacker can repeat login attempts with guessed names and map out valid accounts for later brute-force or phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a WSO2 identity or API product that authenticates users against an external user store such as LDAP or a database. Deployments that use only the built-in user store, or that do not expose the login endpoint to untrusted networks, are less exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.
The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
This page as .md · .json · in your agent: get_signal("CVE-2024-7478")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.