

Security Advisory WSO2-2025-4469/CVE-2025-10470¶

Published: 2026-01-26

Version: 1.0.0

Severity: High

CVSS Score: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

CVE IDs: CVE-2025-10470

AFFECTED PRODUCTS¶

WSO2 Identity Server: 7.0.0

OVERVIEW¶

Potential Denial-of-Service (DoS) vulnerability via Magic Link authentication.

DESCRIPTION¶

This vulnerability impacts only deployments that use the Magic Link authenticator, where multiple invalid authentication requests can cause uncontrolled memory usage growth, resulting in a service unavailability condition.

IMPACT¶

In a deployment where Magic Link feature is used, successful exploitation could result in the complete unavailability of the deployment’s authentication mechanism, preventing legitimate users from accessing the system.

SOLUTION¶

Community Users (Open Source)¶

Apply the relevant fixes to your product using the public fix(es) provided below.

https://github.com/wso2-extensions/identity-local-auth-magiclink/pull/61

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level, or to a higher update level, to mitigate the identified vulnerability.

Info

WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.

Product Name	Product Version	Update Level
WSO2 Identity Server	7.0.0	121