CVE-2024-0391mediumCWE-204

CVE-2024-0391: medium-severity vulnerability in WSO2 Email OTP Authenticator

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

Published

Follow this CVE+ Monitor WSO2 Identity Server+ Monitor WSO2 Identity Server as Key Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
WSO2 · Email OTP AuthenticatorWSO2 · WSO2 Carbon Authenticator Library For EmailOTPWSO2 · WSO2 Identity ServerWSO2 · WSO2 Identity Server as Key ManagerWSO2 · WSO2 Open Banking IAM
Related CVEs — WSO2 Email OTP Authenticator

In the same product, most dangerous first.

CVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2025-10611CRITICALPotential Broken Access Control in Multiple WSO2 Products via System REST APIsEPSS 0.8%CVE-2024-6914CRITICALIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverEPSS 0.8%CVE-2024-7096MEDIUMPrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawEPSS 0.7%CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%