CVE-2024-6832Medium· 5.9▾ SunlitThe account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.
When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.
api_control_plane = 4.5.0api_control_plane = 4.6.0api_manager = 3.1.0api_manager = 3.2.0api_manager = 3.2.1api_manager = 4.1.0api_manager = 4.2.0api_manager = 4.3.0api_manager = 4.4.0api_manager = 4.5.0api_manager = 4.6.0identity_server = 5.10.0identity_server = 5.11.0identity_server = 6.0.0identity_server = 6.1.0identity_server = 7.0.0identity_server_as_key_manager = 5.10.0open_banking_am = 2.0.0open_banking_iam = 2.0.0traffic_manager = 4.5.0traffic_manager = 4.6.0universal_gateway = 4.5.0universal_gateway = 4.6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-15039Critical· 9.4The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured
CVE-2025-8154Medium· 5.3In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a…
CVE-2025-8325Medium· 6.3The software fails to enforce role-based access controls for certain Gateway API invocations
CVE-2025-8591Medium· 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser
CVE-2025-13394Medium· 5.4The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks
CVE-2025-9804Critical· 9.6An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs