---
id: CVE-2024-5563
title: >-
  Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity
  Server Allows Brute Force Attacks
summary: >-
  Due to an incomplete implementation, reCaptcha is not applied to certain
  authentication flows even when the reCaptcha option is enabled. This oversight
  permits attackers to bypass the intended protection mechanism.


  Brute force attacks, …
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: WSO2
product: WSO2 Identity Server
affected:
  - identity_server >= 7.0.0 < 7.0.0.37
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T13:44:40.480Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-5563'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/
tags:
  - cve.org
ingestedAt: '2026-10-21T13:57:01.112Z'
---

## Overview

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

## Affected

- `identity_server >= 7.0.0 < 7.0.0.37`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/#solution