{"id":"CVE-2024-5563","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-5563","generatedAt":"2026-10-28T02:56:43.710Z","title":"This oversight permits attackers to bypass the intended protection mechanism.","description":"Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.\n\nBrute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.","published":"2026-10-21T14:17:05.000Z","lastModified":"2026-10-27T19:10:00.000Z","status":"Deferred","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","cvss":{"version":"3.1","score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-306"],"affected":[],"epss":{"score":0.00192,"percentile":0.08791,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00192,"percentile":0.08411}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T14:17:05.000Z","detail":{"score":"4.8","severity":"MEDIUM","publishedAt":"2026-10-21T14:17:05.230Z"},"summary":"New CVE, medium severity (CVSS 4.8)."}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3436/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-5563","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}