5.8

CVE-2024-7478: wso2 wso2 api manager Observable Response Discrepancy

CVSS: 5.8v3.1MediumAwaiting analysis
Published 21-10-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2024-7478 is a medium (CVSS 5.8) Observable Response Discrepancy vulnerability in wso2 wso2 api manager.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
5.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 21-10-2026
    PublishedVulnerability first disclosed.

Description

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Wso26 products
  • wso2 api manager≥ 3.1.0, < 3.1.0.310 | ≥ 3.2.0, < 3.2.0.401 | ≥ 3.2.1, < 3.2.1.26 | ≥ 4.0.0, < 4.0.0.318 | ≥ 4.1.0, < 4.1.0.180 | ≥ 4.2.0, < 4.2.0.119 | ≥ 4.3.0, < 4.3.0.30
  • wso2 carborn identity handler≥ 1.4.0, < 1.4.0.15 | ≥ 1.4.0, < 1.4.0.16 | ≥ 1.4.11, < 1.4.11.14 | ≥ 1.4.37, < 1.4.37.1 | ≥ 1.6.1, < 1.6.1.5 | ≥ 1.7.1, < 1.7.1.1 | ≥ 1.8.6, < 1.8.6.5 | ≥ 1.8.14, < 1.8.14.1 | ≥ 1.9.2, < 1.9.2.4
  • wso2 identity server≥ 5.10.0, < 5.10.0.326 | ≥ 6.0.0, < 6.0.0.214 | ≥ 6.1.0, < 6.1.0.198 | ≥ 7.0.0, < 7.0.0.67
  • wso2 identity server as key manager≥ 5.10.0, < 5.10.0.320
  • wso2 open banking am≥ 2.0.0, < 2.0.0.351

1 vendor · 6 products

References

1 links