EUVD-2025-209756
GHSA-rv9h-9wv4-5fxx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-facing passwordless flow with no submitted credential (PR:N) and low complexity, but attacker must hold a valid factor for a locked account, keeping C/I/A impact Low.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked.
This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.
AnalysisAI
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV.
Technical ContextAI
WSO2 Identity Server is an open-source enterprise identity and access management (IAM) platform providing federated SSO, adaptive/multi-factor authentication, and passwordless login. The affected components are the passwordless authenticators - the Carbon MagicLink Authenticator Module (email one-time link) and the built-in Passkey/FIDO2 authenticator. The root cause is CWE-863 (Incorrect Authorization): the authentication handlers for these two methods omit the user account-state check (locked/disabled) that the standard password authenticator enforces, so the lock flag is set in the user store but never consulted during the magic-link/passkey login decision. This is an authorization/state-validation gap in the auth pipeline rather than a credential-handling or cryptographic weakness.
RemediationAI
Vendor-released patch: upgrade WSO2 Identity Server to 6.0.0.249, 6.1.0.248, 7.0.0.124, or 7.1.0.31 as matching your branch, and update the Carbon MagicLink Authenticator Module to 1.1.0.1, 1.1.5.2, 1.1.22.5, or 1.1.31.2 as applicable, following WSO2 advisory WSO2-2025-4388 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4388/). If patching must be delayed, the most effective compensating control is to disable the Magic Link and Passkey authenticators for sensitive applications and fall back to password/MFA flows that do honor account lock, at the cost of losing passwordless login convenience; alternatively, restrict which service providers offer these authenticators and monitor authentication logs for successful logins by accounts currently flagged locked. Because lockout is bypassed, also review whether any locked accounts logged in during the exposure window and consider forced password/passkey re-enrollment for them.
More in Wso2 Identity Server
View allAuthentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated att
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentica
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are n
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segrega
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today