CVE-2024-0391: wso2 email otp authenticator Observable Response Discrepancy
Vulnerability summary
CVE-2024-0391 is a medium (CVSS 5.3) Observable Response Discrepancy vulnerability in wso2 email otp authenticator. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.5% of scored vulnerabilities.
Timeline
- 11-05-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
0.00 pp
From 0.18% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wso28 products
- email otp authenticator≥ 1.0.18, < 1.0.18.7
- identity_server≥ 5.10.0, < 5.10.0.379 | ≥ 5.11.0, < 5.11.0.426 | ≥ 6.0.0, < 6.0.0.253 | ≥ 6.1.0, < 6.1.0.254 | ≥ 7.0.0, < 7.0.0.131
- identity_server_as_key_manager≥ 5.10.0, < 5.10.267
- open_banking_iam≥ 2.0.0, < 2.0.0.318
- wso2 carbon authenticator library for emailotp≥ 4.1.0, < 4.1.0.8 | ≥ 4.1.4, < 4.1.4.9 | ≥ 3.0.5, < 3.0.5.8 | ≥ 3.0.24, < 3.0.24.6 | ≥ 3.0.26, < 3.0.26.16
1 vendor · 8 products