CVE-2024-6832 is a medium severity (CVSS 5.9) flaw in several WSO2 products. When a secondary user store is unreachable, account locking can stop working, so repeated wrong passwords for users in healthy stores no longer trigger a lockout. WSO2 tracks it as WSO2-2024-3352, so apply the updates it names.
What's affected
The NVD record lists a group of WSO2 products: API Control Plane, API Manager, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager and Universal Gateway.
The condition matters. The flaw only appears when a secondary user store is configured and cannot be reached. In that state the software does not keep a consistent account locking state, so users in the stores that are still reachable can be guessed at without the expected lockout.
The advisory page is WSO2-2024-3352 on the WSO2 security documentation site. We could not load that page in an automated fetch, so version ranges and fixed releases are not repeated here. Read the advisory and apply the update or the configuration step it gives for your product.
How to check if you're exposed
This one needs a look at configuration, not just version numbers.
- List which WSO2 products you run from the affected list and their versions.
- In each, check whether secondary user stores are configured, for example LDAP, JDBC or Active Directory stores added beside the primary one.
- Check the health of those stores. If any have been unreachable recently, review authentication logs for that period.
- Look for many failed login events for one account with no matching lockout event.
Open the WSO2-2024-3352 advisory for the exact fixed versions or updates and compare with your installation.
What to do now
- Identify WSO2 products and secondary user stores in use.
- Apply the fix or update named in advisory WSO2-2024-3352.
- Monitor user store connectivity and alert when a store goes unreachable.
- Add alerting on bursts of failed logins that is separate from lockout.
- Consider rate limiting at the gateway or load balancer in front of login endpoints.
- Review logs for the periods when a store was down.
Why it matters
Lockout protects accounts only if it works under failure. Here, a problem in one place, an unreachable store, quietly turns off a safety control somewhere else. Attackers cannot cause the outage with this bug, but a real outage or a network fault creates a window.
The record maps this to a failure of a protection mechanism. The fix pattern is to fail closed or to keep lockout state independent of any single store. The score is medium because success needs a specific configuration and a specific failure, and because online guessing is slow unless the passwords are weak.
The weakness class is CWE-693: Protection Mechanism Failure. The CVSS vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, which scores 5.9. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Do I need a secondary user store to be affected?
Yes. The record describes the problem as happening when secondary user stores cannot be reached.
What is the advisory ID?
WSO2 calls it WSO2-2024-3352.
Sources
Last reviewed: 19 October 2026.
