The vulnerability CVE-2024-0391 in WSO2 Identity Server arises from improper validation in the email OTP flow's check user account lock states feature. This causes observable differences in responses that enable an attacker to infer the existence of valid user accounts. The affected versions include 5.10.0, 5.11.0, 6.0.0, 6.1.0, and 7.0.0. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No known exploits are reported in the wild, and no official patch or remediation level has been documented in the vendor advisory or CVE data.

The primary impact is information disclosure of valid usernames through response discrepancies. This can increase the risk of brute-force password attacks and targeted social engineering or phishing campaigns. There is no direct impact on data integrity or system availability. The vulnerability could indirectly lead to reputational harm and regulatory non-compliance if exploited as part of a broader attack chain.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, organizations should monitor vendor communications for updates. In the meantime, consider implementing compensating controls such as rate limiting, anomaly detection on authentication attempts, and minimizing information leakage in authentication responses where feasible.