CVE-2024-5563

MediumCVSS 4.8/10Last modified Oct 21, 2026

Description

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-556305.5Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's CVE-2024-556317.8An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations CVE-2024-556327.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal CVE-2024-556336.5Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially CVE-2024-556348.1A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.CVE-2024-556356.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site S CVE-2024-556369.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.CVE-2024-556379.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.CVE-2024-556389.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102 CVE-2024-556395.5In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The CVE-2024-55648.1A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by send CVE-2024-556415.5In the Linux kernel, the following vulnerability has been resolved: xfs: unlock inodes when erroring out of xfs_trans_alloc_dir Debugging