CVE-2024-7478Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
Updated under an hour ago ()
Does this affect you?
It affects WSO2 API Manager and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
- CVSS
- 5.8 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
- Weakness (CWE)
- CWE-204
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- WSO2
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 21, 2026
- First seen by InfoSec Signals
- Oct 21, 2026
Affected products
WSO2 WSO2 API Manager wso2:api_manager (from the name) | before 3.1.0 status unknown; from 3.1.0 before 3.1.0.310; from 3.2.0 before 3.2.0.401; from 3.2.1 before 3.2.1.26; from 4.0.0 before 4.0.0.318; from 4.1.0 before 4.1.0.180; from 4.2.0 before 4.2.0.119; from 4.3.0 before 4.3.0.30 | CNA record |
WSO2 WSO2 Identity Server as Key Manager wso2:identity_server_as_key_manager (from the name) | before 5.10.0 status unknown; from 5.10.0 before 5.10.0.320 | CNA record |
WSO2 WSO2 Identity Server wso2:identity_server (from the name) | before 5.10.0 status unknown; from 5.10.0 before 5.10.0.326; from 6.0.0 before 6.0.0.214; from 6.1.0 before 6.1.0.198; from 7.0.0 before 7.0.0.67 | CNA record |
WSO2 WSO2 Open Banking IAM wso2:open_banking_iam (from the name) | before 2.0.0 status unknown; from 2.0.0 before 2.0.0.371 | CNA record |
WSO2 WSO2 Open Banking AM wso2:open_banking_am (from the name) | before 2.0.0 status unknown; from 2.0.0 before 2.0.0.351 | CNA record |
WSO2 WSO2 Carborn Identity Handler wso2:carborn_identity_handler (from the name) | from 1.4.0 before 1.4.0.15; from 1.4.0 before 1.4.0.16; from 1.4.11 before 1.4.11.14; from 1.4.37 before 1.4.37.1; from 1.6.1 before 1.6.1.5; from 1.7.1 before 1.7.1.1; from 1.8.6 before 1.8.6.5; from 1.8.14 before 1.8.14.1; and 1 more ranges | CNA record |
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.