PT-2026-39580 · Wso2 · Email Otp Authenticator+7

Published 2026-05-11 · Updated 2026-05-27 · CVE-2024-0391

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The check user account lock states feature within the email OTP flow fails to validate user input. This allows an attacker to infer whether specific user accounts are registered. The discovery of valid usernames can facilitate brute-force and social engineering attacks, such as targeted phishing campaigns, to trick users into revealing sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2024-0391

Affected Products

Email Otp Authenticator

Wso2 Carbon Authenticator Library For Emailotp

Wso2 Identity Server

Wso2 Identity Server As Key Manager

Wso2 Open Banking Am

Identityserver

Identity Server As Key Manager

Open Banking Iam

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-0391 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3115 · Vendor Advisory
• https://twitter.com/CVEnew/status/2053954494942126538 · Twitter Post
• https://t.me/cveNotify/163016 · Telegram Post
• https://t.me/cveNotify/164913 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053813191562408403 · Twitter Post
• https://t.me/CVEtracker/53359 · Telegram Post