---
id: "CVE-2024-7478"
kind: "vulnerability"
aliases: ["CVE-2024-7478"]
title: "WSO2 products: external user store leaks which usernames exist"
severity: "medium"
cvss: 5.8
epss: 0.00235
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["identity", "self-hosted", "vendor", "wso2"]
not_affected_if: ["built-in-user-store-only"]
published_at: "2026-10-21T14:17:06+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:10:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7478", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-7478", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# WSO2 products: external user store leaks which usernames exist

When a WSO2 product uses an external user store, its login flow does not hide whether a username exists or is valid. An attacker can repeat login attempts with guessed names and map out valid accounts for later brute-force or phishing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether a WSO2 product is configured with an external user store (LDAP or JDBC user store outside the built-in one), using the product's user-store settings; unknown if the sources do not say which config keys apply.
- Check the product version against the fixed release listed in the NVD entry; unknown if the sources do not give the affected version range.

## Fix

- Upgrade the affected WSO2 product to the fixed release named in the vendor advisory; unknown if the sources do not give the version.
- Until patched, limit login attempts and watch for many failed logins with different usernames; unknown if the sources give a specific setting.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-7478
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2024-7478

## From the sources

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.

The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_