CVE-2024-1524: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2024-1524 is an authentication bypass vulnerability (CWE-290) affecting WSO2 Identity Server and WSO2 API Manager when the "Silent Just-In-Time (JIT) Provisioning" feature is enabled for a federated identity provider (IDP). A malicious actor can associate a targeted local user account with a federated IDP account they control, effectively hijacking the local account. Affected versions include WSO2 Identity Server 6.0.0 through 6.0.0.170, 6.1.0 through 6.1.0.127, and WSO2 API Manager 4.2.0 through 4.2.0.107. The vulnerability was published on February 24, 2026, with a CVSS v3.1 base score of 8.1 (High) per NVD, and 7.7 (High) per the WSO2 advisory (Red Hat CVE, WSO2 Advisory).

The root cause is improper handling of username collision during the Silent JIT provisioning process (CWE-290: Authentication Bypass by Spoofing). When a federated IDP user authenticates for the first time and their username matches an existing local user store account, the provisioning logic may overwrite or associate the local account with the federated identity — without adequate verification that the two accounts belong to the same person. Exploitation requires: (1) the target deployment has an IDP configured for federated authentication with Silent JIT provisioning enabled; (2) the attacker possesses a fresh, previously unused valid account in the federated IDP; and (3) the attacker knows the username of a valid local user and has registered a matching username at the federated IDP (Red Hat CVE, WSO2 Advisory).

Successful exploitation allows a malicious actor to hijack a targeted local user account by associating it with a federated IDP account under their control, resulting in high confidentiality, integrity, and availability impacts. The attacker effectively gains full access to the victim's account and all resources accessible to that account within the WSO2 deployment. This could enable unauthorized access to sensitive data, modification of user information, and disruption of services for the targeted user (Red Hat CVE, WSO2 Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.049%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by multiple preconditions that must all be satisfied simultaneously, reducing the practical attack surface (Red Hat CVE, WSO2 Advisory).

1. Reconnaissance: Identify a WSO2 Identity Server or API Manager deployment with federated authentication and Silent JIT provisioning enabled. Enumerate or guess valid local usernames (e.g., via exposed APIs, error messages, or OSINT).
2. Account Registration: Register a new, previously unused account at the federated IDP using the exact username of the targeted local user account.
3. Initiate Federated Login: Trigger a federated authentication flow against the WSO2 deployment using the newly created federated IDP account.
4. Account Hijack via JIT Provisioning: During the Silent JIT provisioning process, the WSO2 system associates the federated IDP account with the existing local user account sharing the same username, effectively linking the attacker's federated identity to the victim's local account.
5. Access Victim Account: The attacker now authenticates as the local user, gaining full access to the victim's account, data, and permissions within the WSO2 deployment (Red Hat CVE, WSO2 Advisory).

• Logs: Unexpected account provisioning events in WSO2 audit logs where a federated IDP account is linked to an existing local user account; authentication events showing a local user account being accessed via a federated IDP for the first time without prior federated login history.
• Logs: WSO2 Identity Server or API Manager logs showing JIT provisioning triggered for a username that already exists in the local user store.
• Network: Authentication requests originating from unfamiliar IP addresses or geographic locations for established local user accounts, particularly via federated authentication flows.
• Application: Sudden changes to local user account attributes (email, profile data) coinciding with a federated login event, indicating account information was overwritten during provisioning.

WSO2 has released patches addressing this vulnerability: upgrade WSO2 Identity Server to version 6.0.0.171 or later, or 6.1.0.128 or later; upgrade WSO2 API Manager to version 4.2.0.108 or later. As an immediate workaround, disable the "Silent Just-In-Time Provisioning" feature if it is not required for your deployment. Additional hardening measures include implementing strict username validation to prevent local-federated username collisions, auditing account provisioning activities for suspicious patterns, and restricting which federated IDPs are trusted in the deployment (WSO2 Advisory, Red Hat CVE).

The vulnerability was assigned by WSO2 and tracked under internal advisory WSO2-2024-3144. Red Hat has also published a CVE tracking page for this issue. Community coverage has been limited, with aggregator sites and vulnerability databases picking up the disclosure shortly after publication. No notable independent researcher commentary or significant media coverage has been identified beyond standard vulnerability database entries (Red Hat CVE, WSO2 Advisory).