CVE-2025-10470: Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.
This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10470?
The severity of CVE-2025-10470 is critical due to its potential to cause a denial-of-service condition.
How do I fix CVE-2025-10470?
To fix CVE-2025-10470, implement rate limiting and resource control measures in the Magic Link authentication flow.
What versions of WSO2 Identity Server are affected by CVE-2025-10470?
CVE-2025-10470 affects all versions of WSO2 Identity Server that utilize the Magic Link authentication method.
What are the potential impacts of CVE-2025-10470?
The potential impacts of CVE-2025-10470 include service unavailability and uncontrolled memory usage growth.
Is there a workaround for CVE-2025-10470 while waiting for a patch?
A potential workaround for CVE-2025-10470 is to temporarily disable the Magic Link authentication feature to prevent abuse.