PT-2026-39581 · Wso2 · Wso2 Carbon Magiclink Authenticator Module+2

Published 2026-05-11 · Updated 2026-05-27 · CVE-2025-10908

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A lack of user account state validation during authentication allows locked user accounts to be successfully accessed using Magic Link or Pass Key methods. This bypasses security controls designed to restrict access to locked accounts, potentially leading to unauthorized access to applications and sensitive data, while undermining the account lock mechanism intended to prevent further login attempts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-10908

Affected Products

Wso2 Carbon Magiclink Authenticator Module

Wso2 Identity Server

Identityserver

References · 7

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10908 · Security Note
• https://twitter.com/CVEnew/status/2053954492966539411 · Twitter Post
• https://t.me/cveNotify/163017 · Telegram Post
• https://t.me/CVEtracker/53360 · Telegram Post
• https://t.me/cveNotify/164914 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053808072158490878 · Twitter Post