The vulnerability arises because the account locking mechanism in WSO2 Enterprise Integrator 6.6.0 does not maintain a consistent state when secondary user stores cannot be reached. As a result, the lockout mechanism is bypassed for users in accessible stores, enabling attackers to perform repeated invalid login attempts without triggering account lockout. This is classified under CWE-693 (Protection Mechanism Failure). No official patch or remediation level has been published by the vendor at this time.

Users in accessible user stores remain vulnerable to brute force attacks since the account lockout mechanism does not trigger when secondary user stores are unreachable. This could lead to unauthorized access if an attacker successfully guesses credentials. The confidentiality impact is high, while integrity and availability impacts are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor authentication attempts and consider additional protective controls such as multi-factor authentication to mitigate brute force risks.