Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-10470

Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 7.0.0 to < 7.0.0.121affected

WSO2 WSO2 Carbon MagicLink Authenticator Module

Default version status: unknown

  • 1.1.22 to < 1.1.22.3affected
  • 1.1.31 to ≤ *unaffected

References