The vulnerability CVE-2024-0391 in WSO2 Identity Server arises from improper validation in the email OTP flow's check for user account lock states. This leads to observable differences in responses that enable attackers to confirm the existence of user accounts. The affected versions include 5.10.0, 5.11.0, 6.0.0, 6.1.0, and 7.0.0. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. No official patch or remediation guidance is currently documented, and no known exploits are reported in the wild.

An attacker can leverage this vulnerability to enumerate valid usernames by observing response discrepancies during the email OTP flow. This information disclosure increases the risk of targeted brute-force attacks and social engineering campaigns such as phishing. While the vulnerability does not directly allow data modification or denial of service, the indirect impact includes potential compromise of user accounts and reputational damage to the organization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, organizations should monitor WSO2 advisories for updates. Until a patch is available, consider restricting access to the affected functionality or implementing additional rate limiting and monitoring to detect enumeration attempts.