What is the CVSS score of CVE-2025-10470?

CVE-2025-10470 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of WSO2 Identity Server are affected by CVE-2025-10470?

CVE-2025-10470 is a high-severity denial-of-service vulnerability in WSO2Identity Server's Magic Link authenticator that allows unauthenticated attackers to crash the authentication service through…. A patch is available.

How to fix or mitigate CVE-2025-10470?

Within 24 hours: Identify all WSO2 Identity Server deployments using Magic Link authenticator and document current versions. Within 7 days: Implement network-level rate limiting on authentication endpoints and enable request throttling at the load balancer or WAF to block excessive failed login attempts from single IPs. Within 30 days: Monitor WSO2-2025-4469 advisory for patch release and test patch deployment in non-production environments immediately upon availability; apply vendor patch to all affected instances.

WSO2 Identity Server CVE-2025-10470

EUVD-2025-209760 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-11 WSO2

GHSA-3xrw-97cx-wwgf

Denial Of Service Wso2 Identity Server Wso2 Carbon Magiclink Authenticator Module

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

May 11, 2026 - 12:01 EUVD

Analysis Generated

May 11, 2026 - 11:45 vuln.today

CVE Published

May 11, 2026 - 10:16 nvd

HIGH 8.6

DescriptionCVE.org

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.

This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.

AnalysisAI

Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated attackers to crash the authentication service by flooding invalid login requests without rate limiting. The vulnerability affects deployments using the Magic Link authentication flow and has an EPSS score indicating moderate exploitation likelihood. WSO2 has published a security advisory (WSO2-2025-4469) with remediation guidance for affected Identity Server and Carbon MagicLink Authenticator Module installations.

Technical ContextAI

This vulnerability stems from inadequate resource management (CWE-400: Uncontrolled Resource Consumption) in WSO2's Magic Link passwordless authentication implementation. Magic Link authenticators generate time-limited authentication URLs sent via email or SMS, but the affected code fails to implement proper rate limiting or memory bounds when processing invalid authentication requests. Each invalid request allocates memory without cleanup, causing linear memory growth until the JVM heap is exhausted or the authentication service becomes unresponsive. The issue specifically affects the WSO2 Carbon MagicLink Authenticator Module integrated into WSO2 Identity Server deployments, impacting the authentication subsystem rather than the entire identity platform.

RemediationAI

Apply vendor-supplied patches documented in WSO2 Security Advisory WSO2-2025-4469 available at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/, which includes specific patch versions for affected Identity Server releases and Carbon MagicLink Authenticator Module versions. If immediate patching is not feasible, implement compensating controls: deploy rate limiting at the reverse proxy or web application firewall layer targeting Magic Link authentication endpoints (typically /commonauth or /authenticationendpoint paths), limiting requests to 10-20 per minute per source IP; configure JVM memory monitoring with automated service restart on heap threshold (80-90% utilization) to maintain availability during attacks, though this allows continued service disruption; temporarily disable Magic Link authenticator and revert to password-based or SAML/OIDC federation authentication, which eliminates attack surface but removes passwordless login convenience for end users. Each mitigation trades off protection for operational complexity or user experience degradation, with patching remaining the only complete remediation without functional compromise.