CVE-2025-10470 — Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

Description (CNA)

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

Affected (CNA)

Vendor / product	Versions
WSO2 / WSO2 Identity Server	affected 7.0.0 before 7.0.0.121
WSO2 / WSO2 Carbon MagicLink Authenticator Module	affected 1.1.22 before 1.1.22.3; unaffected 1.1.31 through *

CWE

CWE-400

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.