PT-2026-39592 · Wso2 · Wso2 Carbon Magiclink Authenticator Module+2

Published 2026-05-11 · Updated 2026-05-27 · CVE-2025-10470

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The Magic Link authentication flow lacks adequate rate limiting or resource control, allowing it to accept multiple invalid authentication requests. This leads to uncontrolled memory usage growth, which can result in a denial-of-service condition and cause service unavailability for deployments utilizing the Magic Link authenticator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable Magic Link deployments as a mitigation measure.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-10470

Affected Products

Wso2 Carbon Magiclink Authenticator Module

Wso2 Identity Server

Identityserver

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10470 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469 · Vendor Advisory
• https://t.me/cveNotify/163025 · Telegram Post
• https://t.me/CVEtracker/53371 · Telegram Post
• https://t.me/cveNotify/164906 · Telegram Post
• https://twitter.com/0x2ed3bb60/status/2053825466113700264 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1tax0si/top_10_trending_cves_12052026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2053820873539248568 · Twitter Post
• https://twitter.com/CVEnew/status/2053954483244208399 · Twitter Post