PT-2026-39592 · Wso2 · Wso2 Carbon Magiclink Authenticator Module+1

Published 2026-05-11 · Updated 2026-05-11 · CVE-2025-10470

NVD

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.

This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-10470

Affected Products

Wso2 Carbon Magiclink Authenticator Module

Wso2 Identity Server

References · 2

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10470 · Security Note