CVE-2025-10470

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El flujo de autenticación Magic Link acepta múltiples solicitudes de autenticación inválidas sin una limitación de tasa o control de recursos adecuados, lo que lleva a un crecimiento descontrolado del uso de memoria. Esta vulnerabilidad puede resultar en una condición de denegación de servicio, causando indisponibilidad del servicio para las implementaciones que utilizan el autenticador Magic Link. El impacto se limita a estas implementaciones específicas y requiere intentos de autenticación inválidos repetidos para activarse.

Information

Published : 2026-05-11 12:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-10470

Mitre link : CVE-2025-10470

CVE.ORG link : CVE-2025-10470

JSON object : View

Products Affected

wso2

identity_server

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-10470", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10470", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T12:38:30.354857Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.121", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon MagicLink Authenticator Module", "versions": [{"status": "affected", "version": "1.1.22", "lessThan": "1.1.22.3", "versionType": "custom"}, {"status": "unaffected", "version": "1.1.31", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.local.auth.magiclink:org.wso2.carbon.identity.application.authenticator.magiclink", "defaultStatus": "unknown"}]}], "published": "2026-05-11T12:16:10.530", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.\n\nThis vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger."}, {"lang": "es", "value": "El flujo de autenticaci\u00f3n Magic Link acepta m\u00faltiples solicitudes de autenticaci\u00f3n inv\u00e1lidas sin una limitaci\u00f3n de tasa o control de recursos adecuados, lo que lleva a un crecimiento descontrolado del uso de memoria.\n\nEsta vulnerabilidad puede resultar en una condici\u00f3n de denegaci\u00f3n de servicio, causando indisponibilidad del servicio para las implementaciones que utilizan el autenticador Magic Link. El impacto se limita a estas implementaciones espec\u00edficas y requiere intentos de autenticaci\u00f3n inv\u00e1lidos repetidos para activarse."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F43F1743-352F-49D8-B009-E6C77DED8B30", "versionEndExcluding": "7.0.0.121", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}