CVE-2025-10470

Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

State: Published
Severity: 8.6 High
Published: May 11, 2026
Updated: May 11, 2026
Reserved: Sep 15, 2025

Description

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.

This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	WSO2

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
WSO2 Identity ServerWSO2	7.0.0 to before 7.0.0.121Affected
WSO2 Carbon MagicLink Authenticator ModuleWSO2	1.1.22 to before 1.1.22.3Affected 1.1.31 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.