The vulnerability arises because the account locking mechanism in WSO2 Enterprise Integrator 6.6.0 does not maintain a consistent state when it cannot reach all configured user stores, particularly secondary ones. As a result, the lockout mechanism is bypassed for users in accessible stores, enabling attackers to perform unlimited invalid authentication attempts without triggering account lockout. This is classified under CWE-693 (Protection Mechanism Failure).

Users in accessible user stores are vulnerable to brute force attacks due to the failure of the account lockout mechanism when secondary user stores are unreachable. This can lead to unauthorized access if attackers successfully guess passwords. The CVSS score is 5.9 (medium severity), indicating a moderate impact primarily on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor authentication attempts and consider additional protective controls such as multi-factor authentication or limiting access to user stores to reduce risk.