CVE-2024-1524: Authentication Bypass Vulnerability

CVE-2024-1524 Overview

CVE-2024-1524 is an Authentication Spoofing vulnerability affecting WSO2 Identity Server deployments utilizing the "Silent Just-In-Time Provisioning" feature for federated identity providers (IDPs). When this feature is enabled, a malicious actor can exploit username collisions between federated and local user stores to associate a targeted local user account with a federated IDP user account under their control.

The vulnerability arises from improper authentication origin verification (CWE-290) during the account provisioning process. When federated users share the same username as local users, the local user's information may be replaced during provisioning, effectively allowing account takeover.

Critical Impact

Attackers with valid federated IDP accounts can hijack local user accounts by exploiting username matching during Silent JIT provisioning, leading to unauthorized access and identity impersonation.

Affected Products

• WSO2 Identity Server with Silent Just-In-Time Provisioning enabled
• WSO2 deployments with federated IDP configurations

Discovery Timeline

• 2026-02-24 - CVE CVE-2024-1524 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2024-1524

Vulnerability Analysis

This vulnerability stems from improper authentication origin verification (CWE-290) in the Silent Just-In-Time (JIT) Provisioning mechanism. The core issue is that the provisioning process fails to adequately distinguish between identities from federated identity providers and those from local user stores when usernames match.

For successful exploitation, the following preconditions must be met:

1. An IDP must be configured for federated authentication with Silent JIT provisioning enabled
2. The attacker must possess a fresh, previously unused valid user account in the federated IDP
3. The attacker must know the username of a valid user in the local IDP
4. The attacker's federated IDP account must have a username matching the targeted local user

When all conditions are satisfied, the provisioning process incorrectly associates the federated identity with the existing local account, effectively granting the attacker access to the victim's account.

Root Cause

The root cause is classified as CWE-290: Authentication Bypass by Spoofing. The Silent JIT provisioning mechanism does not properly verify the authentication origin when linking federated identities to local accounts. This allows an attacker to leverage a username collision to impersonate local users through their federated IDP credentials.

Attack Vector

The attack is network-based and requires the attacker to authenticate through a configured federated IDP with specific preconditions. The attacker must:

1. Identify a target username that exists in the local user store
2. Create or obtain a matching username account in the federated IDP
3. Authenticate via the federated IDP for the first time (fresh account requirement)
4. The Silent JIT provisioning process then incorrectly links the federated identity to the local account

The attack does not require user interaction but has high complexity due to the multiple preconditions that must be satisfied. Once successful, the attacker gains full access to the victim's local account with high confidentiality and integrity impact.

Detection Methods for CVE-2024-1524

Indicators of Compromise

• Unexpected changes to local user account attributes following federated authentication events
• Multiple federated IDP accounts being linked to the same local user account
• Authentication logs showing federated login attempts using usernames that match local accounts
• User reports of account compromise following federated authentication system integration

Detection Strategies

• Monitor provisioning logs for Silent JIT provisioning events involving username matches between federated and local accounts
• Implement alerting on account attribute modifications that occur during federated authentication flows
• Audit federated IDP configurations to identify deployments with Silent JIT provisioning enabled
• Review authentication logs for first-time federated logins using usernames that already exist in local stores

Monitoring Recommendations

• Enable detailed logging for all JIT provisioning operations including source IDP identification
• Implement real-time monitoring of user account linking events between federated and local stores
• Configure alerts for any local account modifications triggered by federated authentication
• Establish baseline behavior for federated provisioning and alert on anomalies

How to Mitigate CVE-2024-1524

Immediate Actions Required

• Disable Silent Just-In-Time Provisioning until patches can be applied
• Audit existing user accounts for unauthorized federated identity linkages
• Review federated IDP configurations and restrict to trusted identity providers only
• Implement username uniqueness enforcement across local and federated user stores

Patch Information

WSO2 has released security guidance for this vulnerability. Organizations should refer to the WSO2 Security Advisory WSO2-2024-3144 for specific patch information and remediation guidance. Apply the recommended patches or configuration changes as soon as possible.

Workarounds

• Disable Silent JIT provisioning and switch to explicit provisioning workflows that require administrator approval
• Implement username collision detection that prevents federated account linking when local usernames already exist
• Deploy multi-factor authentication for all federated login scenarios to add additional verification
• Configure federated IDP account linkage to require explicit user consent before associating with local accounts
• Establish namespace separation between local and federated usernames to prevent collisions