CVE-2024-6832: Account Lock Bypass Vulnerability

CVE-2024-6832 Overview

CVE-2024-6832 describes a security control failure in the account locking mechanism of affected WSO2 products. The lockout function does not maintain a consistent state when the software cannot reach all configured user stores. As a result, an attacker can repeatedly submit invalid credentials against accounts in accessible user stores without triggering the expected lockout. This weakness enables brute-force attacks on valid user accounts and is tracked under [CWE-693: Protection Mechanism Failure].

Critical Impact
Attackers can bypass the account lockout policy and perform sustained brute-force attempts against user accounts when any secondary user store is unreachable.

Affected Products

WSO2 products referenced in advisory WSO2-2024-3352
Deployments using multiple configured user stores
Environments where secondary user stores may become unreachable

Discovery Timeline

2026-08-06 - CVE-2024-6832 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2024-6832

Vulnerability Analysis

The vulnerability resides in the account locking logic used across configured user stores. WSO2 identity products can federate authentication across a primary user store and one or more secondary user stores. When the platform cannot reach every configured store, the lockout counter is not consistently updated or enforced. Failed authentication attempts against users in reachable stores therefore do not accumulate toward the lockout threshold. Attackers exploit this inconsistency to iterate through credential candidates without triggering account suspension.

Root Cause

The root cause is a protection mechanism failure [CWE-693]. The lockout subsystem depends on state that requires successful communication with all configured user stores. When a secondary store returns errors or is unreachable, the lockout evaluation aborts or falls through instead of failing closed. The design does not enforce a safe default that continues to track and apply lockout policy for the user stores that are available.

Attack Vector

The attack is remote and unauthenticated. An attacker submits repeated authentication requests against a known or guessed username via the standard authentication endpoints. The attack succeeds only when at least one configured secondary user store is inaccessible during the attempts. Under those conditions, the attacker can issue an unlimited number of password guesses without lockout. The high attack complexity reflects the requirement that a secondary user store must be in an unreachable state during the attempt window.

No verified public exploit is available. See the WSO2 Security Advisory WSO2-2024-3352 for technical details.

Detection Methods for CVE-2024-6832

Indicators of Compromise

Elevated volumes of failed authentication events for one or more usernames without matching account lockout events.
Authentication server logs showing repeated connection failures or timeouts to a secondary user store.
Failed logins from a single source IP that continue beyond the configured lockout threshold.
Successful logins that follow long sequences of failed attempts against the same account.

Detection Strategies

Correlate authentication failure counts per user with account lockout events, and alert when the ratio deviates from baseline.
Monitor user store connector health metrics and generate alerts when secondary stores become unreachable during authentication activity.
Detect brute-force patterns using rate-based rules on the authentication endpoints, independent of the application-layer lockout counter.

Monitoring Recommendations

Forward WSO2 authentication and audit logs to a central SIEM or data lake for correlation across identity events.
Track secondary user store availability as a first-class monitored signal, not only an operational metric.
Baseline expected failed-login volumes per user and per source, and alert on statistically significant increases.

How to Mitigate CVE-2024-6832

Immediate Actions Required

Review the WSO2 Security Advisory WSO2-2024-3352 and apply the fixes or WUM updates for affected product versions.
Verify the health and reachability of all configured secondary user stores and remediate any connectivity issues.
Audit authentication logs for evidence of brute-force patterns that did not result in account lockout.

Patch Information

WSO2 has published remediation guidance in advisory WSO2-2024-3352. Administrators should apply the vendor-provided updates or configuration changes described in the advisory to restore correct enforcement of account lockout when a secondary user store is unreachable.

Workarounds

Enforce brute-force protection at the network perimeter using a web application firewall (WAF) with rate limiting on authentication endpoints.
Restrict access to authentication endpoints to trusted networks or require multi-factor authentication for all users.
Configure monitoring to fail closed by disabling authentication paths that depend on unreachable secondary user stores until connectivity is restored.

bash

# Example WAF rate limit on the authentication endpoint
# Limit each source IP to 5 authentication attempts per minute
limit_req_zone $binary_remote_addr zone=authlimit:10m rate=5r/m;

location /oauth2/token {
    limit_req zone=authlimit burst=5 nodelay;
    proxy_pass https://wso2-identity-server;
}