CVE-2024-5617 Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowin...

CVE-2024-5617

A functional flaw in WSO2 products allows an account lock bypass when users with identical usernames exist in both primary and secondary user stores . The system incorrectly applies the lock condition only to the secondary user store account, failing to enforce lockouts on the primary store accou...