Is CVE-2024-0391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-0391 being exploited in the wild.

How severe is CVE-2024-0391?

Medium severity, with a CVSS score of 5.3, published 11 May 2026.

Which products and versions are affected?

Wso2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.0.0, 6.1.0, 6.0.0, 5.11.0, 5.10.0; Wso2 Identity Server as Key Manager 5.10.0; Wso2 Open Banking IAM 2.0.0.

Is there a fix for CVE-2024-0391?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-0391 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-0391?

Check whether you run Wso2 Identity Server, Wso2 Identity Server as Key Manager or Wso2 Open Banking IAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-0391: WSO2 Identity Server username enumeration in email OTP flow

CVE-2024-0391 · Severity: medium · CVSS 5.3 · Published 2026-05-11

WSO2 Identity Server, a tool used for managing user identities and access, contains a flaw in its email-based login process. An attacker can use this flaw to verify whether specific email addresses or usernames are registered in the system. This information can be used to launch targeted phishing campaigns or brute-force login attempts against known valid accounts.

Technologies: Wso2 Identity Server, Wso2 Identity Server as Key Manager, Wso2 Open Banking IAM. Vendors: Wso2.

Quick answers

Is CVE-2024-0391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-0391 being exploited in the wild.
How severe is CVE-2024-0391?: Medium severity, with a CVSS score of 5.3, published 11 May 2026.
Which products and versions are affected?: Wso2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.0.0, 6.1.0, 6.0.0, 5.11.0, 5.10.0; Wso2 Identity Server as Key Manager 5.10.0; Wso2 Open Banking IAM 2.0.0.
Is there a fix for CVE-2024-0391?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-0391 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-0391?: Check whether you run Wso2 Identity Server, Wso2 Identity Server as Key Manager or Wso2 Open Banking IAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A username enumeration vulnerability exists in WSO2 Identity Server due to an observable response discrepancy (CWE-204) in the email OTP flow. Specifically, the feature that checks user account lock states does not properly validate or normalize responses for existing versus non-existing users. A remote, unauthenticated attacker can exploit this by sending crafted requests to the email OTP endpoint to identify valid registered accounts. This information leakage facilitates subsequent brute-force or social engineering attacks. Fixes are available via GitHub pull requests for community users and specific update levels for support subscribers.

Affected products

WSO2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0
WSO2 Identity Server as Key Manager 5.10.0
WSO2 Open Banking IAM 2.0.0

Timeline

2026-01-26: advisory: Initial advisory published by WSO2
2026-05-11: disclosed: CVE published to NVD

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.