CVE-2024-8122: CWE-613: Insufficient Session Expiration in WSO2 WSO2 Identity Server

The WSO2 Identity Server fails to enforce automatic expiration for SMS OTPs in MFA, resulting in OTPs that remain valid indefinitely if unused. This insufficient session expiration (CWE-613) allows attackers unlimited time to guess OTPs via brute force. The vulnerability affects versions >=5.11.0 <5.11.0.372, >=6.0.0 <6.0.0.227, and >=6.1.0 <6.1.0.219. The CVSS 3.1 base score is 5.9 (medium severity), with network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild or vendor patch links are provided.

The vulnerability allows attackers to bypass MFA by brute forcing SMS OTPs that do not expire, potentially leading to unauthorized account access and compromising confidentiality of user accounts. There is no reported impact on integrity or availability. The medium CVSS score reflects the moderate risk due to high attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider additional compensating controls such as enforcing manual OTP expiration policies if configurable, monitoring for suspicious authentication attempts, or using alternative MFA methods with enforced expiration. No official patch or temporary fix information is provided in the input data.