Medium severity · published Oct 21, 2026
CVE-2024-5563
Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.
Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
WSO2 Identity Server · WSO2
7.0.0 before 7.0.0.37 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5563
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5563
security.docs.wso2.com
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/
More from WSO2 Identity Server
9.4
CVE-2025-15039
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
9.1
CVE-2024-4457
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
9.1
CVE-2024-2374
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
8.6
CVE-2025-10470
Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
8.4
CVE-2025-12737
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution