Vulnerability · Published May 11, 2026 · Assigned by WSO2
CVE-2025-10470Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
High 8.6
In plain English
A high-severity uncontrolled resource consumption in WSO2 Carbon MagicLink Authenticator Module from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Identity Server | 7.0.0 – before 7.0.0.121 |
| WSO2 | WSO2 Carbon MagicLink Authenticator Module | 1.1.22 – before 1.1.22.3 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H