CVE-2025-10470 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

High 8.6 Published 11 May 2026 Updated 11 May 2026

Attackers can cause service unavailability in WSO2 Identity Server by exploiting uncontrolled memory usage in the Magic Link authentication flow.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-10470?

CVE-2025-10470 is a high-severity denial of service vulnerability in Wso2 Identity Server, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.

This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

Weakness: CWE-400

Which versions are affected by CVE-2025-10470?

It affects 1 product.

Products include Wso2 Identity Server.

How do I fix CVE-2025-10470?

No fix has been published for CVE-2025-10470 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-10470 being exploited?

There is no known exploitation of CVE-2025-10470 in the wild and no public exploit code.

All Wso2 Identity Server vulnerabilities

Sources

Also known as GHSA-3xrw-97cx-wwgf.