Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2024-0391 The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accoun… https://www.cve.org/CVERecord?id=CVE-2024-0391
Post summary
The entry announces CVE‑2024‑0391, providing technical details on a user enumeration flaw in an email OTP flow, but offers no PoC, exploit, or mitigation information.
CVE-2024-0391 User Account Enumeration via Email OTP Flow Input Validation Failure https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-0391
Post summary
The entry references CVE-2024-0391, briefly describing an input‑validation weakness that could lead to user enumeration, but lacks any PoC, exploit code, patch, or active exploitation details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wso2 | identity_server | - | - | - |
| App | wso2 | identity_server_as_key_manager | - | - | - |
| App | wso2 | open_banking_iam | - | - | - |