WSO2 Carbon MagicLink Authenticator Module vulnerabilities

2 known vulnerabilities in WSO2 Carbon MagicLink Authenticator Module from WSO2. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  WSO2 Identity Server: Uncontrolled Resource Consumption

  CVE-2025-10470May 11, 2026WSO2

  The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service

• 7.3 High severity

  WSO2 Identity Server: Incorrect Authorization

  CVE-2025-10908May 11, 2026WSO2

  Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been