High severity · published May 11, 2026
CVE-2025-10470
Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
8.6
CVSS
0.3%
EPSS
No
On KEV
Description
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.
This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
WSO2 Carbon MagicLink Authenticator Module · WSO2
1.1.22 before 1.1.22.3 · source: vendor
WI
WSO2 Identity Server · WSO2
7.0.0 before 7.0.0.121 · source: vendor
IS
Identity Server · Wso2
7.0.0 before 7.0.0.121 · source: NVD
Affected product
WC
WSO2 Carbon MagicLink Authenticator Module
WSO2
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10470
Vendor Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/
More from WSO2 Carbon MagicLink Authenticator Module
7.3
CVE-2025-10908
Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
4.3
CVE-2025-13909
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
