CVE-2024-5563: CWE-306: πιστη του client στο "login"" in WSO2 WSO2 Identity Server

This vulnerability arises from an incomplete implementation of reCaptcha in WSO2 Identity Server, where some authentication flows do not enforce reCaptcha even when the option is enabled. This bypass allows attackers to perform brute force attacks against user credentials. Successful exploitation could lead to unauthorized access to user accounts and exposure of sensitive information. The affected versions are from 7.0.0 up to but excluding 7.0.0.37. There are no known exploits in the wild and no vendor-provided patch or advisory details are available in the provided data.

If exploited, attackers can bypass reCaptcha protections and perform brute force attacks against authentication endpoints. This can result in unauthorized access to user accounts and compromise of sensitive information. The impact is limited to confidentiality and integrity with no reported availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider additional protective measures such as monitoring for brute force attempts and applying compensating controls to authentication flows not covered by reCaptcha.