CVE-2024-5563

MediumCVSS 4.8/10Last modified Oct 30, 2026

Description

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
WSO2WSO2 Identity Server>= 7.0.0, < 7.0.0.37

References

Timeline

Published
Oct 21, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-556305.5Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin'sCVE-2024-556317.8An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installationsCVE-2024-556327.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalCVE-2024-556336.5Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a speciallyCVE-2024-556348.1A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.CVE-2024-556356.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site SCVE-2024-556369.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.CVE-2024-556379.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.CVE-2024-556389.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102CVE-2024-556395.5In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The CVE-2024-55648.1A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sendCVE-2024-556415.5In the Linux kernel, the following vulnerability has been resolved: xfs: unlock inodes when erroring out of xfs_trans_alloc_dir Debugging
CVE-2024-5563: Medium severity, CVSS 4.8 | Vulnix