CVE-2024-0391

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2024
Source publication: May 11, 2026
Source updated: May 11, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 Identity Server

Vendor: WSO2
Product: WSO2 Identity Server
Platforms: Unknown
Default status: unaffected

WSO2 Identity Server · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	5.10.0	Unavailable	None listed
5.10.0	`affected`	custom	5.10.0.379	Unavailable	None listed
5.11.0	`affected`	custom	5.11.0.426	Unavailable	None listed
5.11.0	`affected`	custom	5.11.0.431	Unavailable	None listed
6.0.0	`affected`	custom	6.0.0.253	Unavailable	None listed
6.1.0	`affected`	custom	6.1.0.254	Unavailable	None listed
7.0.0	`affected`	custom	7.0.0.131	Unavailable	None listed

WSO2 Open Banking IAM

Vendor: WSO2
Product: WSO2 Open Banking IAM
Platforms: Unknown
Default status: unaffected

WSO2 Open Banking IAM · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	2.0.0	Unavailable	None listed
2.0.0	`affected`	custom	2.0.0.318	Unavailable	None listed

WSO2 Identity Server as Key Manager

Vendor: WSO2
Product: WSO2 Identity Server as Key Manager
Platforms: Unknown
Default status: unaffected

WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	5.10.0	Unavailable	None listed
5.10.0	`affected`	custom	5.10.0.267	Unavailable	None listed

Email OTP Authenticator

Vendor: WSO2
Product: Email OTP Authenticator
Platforms: Unknown
Default status: unknown
Package: org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp

Email OTP Authenticator · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.0.18	`affected`	custom	1.0.18.7	Unavailable	None listed
1.0.24	`unaffected`	custom	Unavailable	*	None listed

WSO2 Carbon Authenticator Library For EmailOTP

Vendor: WSO2
Product: WSO2 Carbon Authenticator Library For EmailOTP
Platforms: Unknown
Default status: unknown
Package: org.wso2.carbon.extension.identity.authenticator.outbound.emailotp:org.wso2.carbon.identity.authenticator.emailotp

WSO2 Carbon Authenticator Library For EmailOTP · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
4.1.0	`affected`	custom	4.1.0.8	Unavailable	None listed
4.1.4	`affected`	custom	4.1.4.9	Unavailable	None listed
4.1.22	`unaffected`	custom	Unavailable	*	None listed

WSO2 Carbon Authenticator Library For EmailOTP

Vendor: WSO2
Product: WSO2 Carbon Authenticator Library For EmailOTP
Platforms: Unknown
Default status: unknown
Package: org.wso2.carbon.extension.identity.authenticator.outbound.emailotp:org.wso2.carbon.extension.identity.authenticator.emailotp.connector

WSO2 Carbon Authenticator Library For EmailOTP · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.5	`affected`	custom	3.0.5.8	Unavailable	None listed
3.0.24	`affected`	custom	3.0.24.6	Unavailable	None listed
3.0.26	`affected`	custom	3.0.26.16	Unavailable	None listed