CVE-2024-7478: CWE-204: Indicator Discrepancies in WSO2 WSO2 API Manager

When WSO2 API Manager is configured to use an external user store, it fails to adequately obscure the existence or validity of usernames during authentication attempts. This allows an attacker to repeatedly query the authentication mechanism with different username guesses to enumerate valid usernames. The vulnerability is identified as CWE-204 (Indicator Discrepancies) and affects a broad range of versions across multiple major releases. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and limited confidentiality impact. No known exploits in the wild or official patch links were provided in the input data.

The vulnerability enables attackers to enumerate valid usernames in the external user store, increasing the risk of targeted brute-force attacks and social engineering campaigns such as phishing. This information leakage can lead to reputational damage, regulatory non-compliance, and potential legal and financial consequences for affected organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, organizations should monitor authentication mechanisms for unusual username enumeration attempts and consider implementing additional protections such as rate limiting or CAPTCHA on authentication endpoints to reduce the risk of enumeration.