CVE-2024-8122 in Identity Server
Summary
by MITRE • 10/08/2026
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP.
The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified within WSO2 Identity Server represents a critical failure in the implementation of multi-factor authentication protocols, specifically concerning the lifecycle management of SMS-based One-Time Passwords. In secure identity systems, time-bound tokens are essential to limit the window of opportunity for attackers. However, this flaw allows OTPs sent via SMS to remain valid indefinitely if they are not consumed during an initial login attempt. This design oversight fundamentally undermines the security model by removing the temporal constraint that is central to the effectiveness of one-time credentials. The system fails to enforce a default expiry time, which contradicts established best practices for handling transient authentication secrets and exposes users to prolonged periods of risk after their credentials have been issued but not utilized.
From a technical perspective, this issue stems from an absence of automatic expiration logic within the OTP generation and validation modules. When an SMS containing a verification code is dispatched, the backend system does not set a timeout mechanism or check for staleness during subsequent authentication requests. Consequently, any previously generated OTP remains active in the server's state until it is either successfully used to authenticate a user or manually invalidated through administrative action. This behavior creates a persistent attack surface where historical codes can be replayed indefinitely. The lack of expiration means that even if an attacker intercepts an old SMS message from days or weeks prior, they retain the ability to attempt authentication using that specific code without restriction.
The operational impact of this vulnerability is severe, primarily facilitating brute force attacks against user accounts. Because there is no limit on the number of attempts allowed within a given timeframe for these expired-but-still-valid codes, malicious actors can employ automated scripts to guess OTPs with high frequency and low detection risk. A successful brute force attack leads directly to an MFA bypass, allowing unauthorized access to sensitive systems and data. This results in the complete compromise of user identity, leading to potential financial loss, privacy violations, and reputational damage for both individuals and organizations relying on WSO2 Identity Server for secure access control. The persistence of valid tokens amplifies the risk significantly compared to standard implementations where codes expire within minutes.
This vulnerability aligns with CWE-613, which describes insufficient session expiration, as well as CWE-798, concerning the use of hardcoded or default credentials that remain active without proper lifecycle management. In terms of offensive security frameworks, this flaw supports techniques associated with MITRE ATT&CK Tactic TA0004 (Privilege Escalation) and specifically Technique T1110.003 (Brute Force: Password Guessing for Web Applications). The ability to reuse old tokens effectively extends the window for credential stuffing and brute force operations, making it easier for adversaries to gain initial access without triggering typical rate-limiting or account lockout mechanisms designed for fresh sessions.
To mitigate this risk, immediate remediation is required by configuring WSO2 Identity Server to enforce strict expiration policies on all SMS OTPs. Administrators should set a reasonable time-to-live value, typically between five and fifteen minutes, ensuring that any unused code becomes invalid shortly after issuance. This change must be applied at the configuration level for the specific authentication endpoint handling SMS verification. Additionally implementing rate limiting based on IP address or user identity can further reduce the effectiveness of brute force attempts by throttling repeated validation requests regardless of OTP validity status. Regular security audits and penetration testing should also be conducted to verify that temporal constraints are correctly enforced across all multi-factor authentication flows, ensuring compliance with industry standards for secure session management and credential handling.