WSO2 Identity Server EUVD-2025-209760

Magic Link authenticator must be actively configured and enabled in at least one authentication flow within the WSO2 Identity Server deployment - this is a non-default optional feature requiring explicit administrator configuration. Exploitation requires network access to the Identity Server authentication endpoints (typically exposed on ports 9443/HTTPS or 9763/HTTP) from any internet-connected host, with no authentication, credentials, or user interaction needed. Default WSO2 Identity Server installations using standard password, federated, or multi-factor authentication without Magic Link configuration are NOT vulnerable. Attack effectiveness depends on available JVM heap size and request rate - smaller heap allocations or bandwidth-constrained attackers may require extended flooding duration (hours vs. minutes) to achieve denial-of-service.

The CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) reflects severe availability impact with network-based unauthenticated exploitation against low-complexity targets, with changed scope indicating impact beyond the vulnerable component. However, real-world risk is moderated by several factors: exploitation requires sustained request flooding specifically against Magic Link authentication endpoints, impact is isolated to deployments actively using this optional authenticator (not default configurations), and the attack produces only denial-of-service without data compromise or persistence. No CISA KEV listing or public exploit code identified at time of analysis, suggesting attacks remain theoretical rather than widespread. Organizations not using Magic Link authentication are unaffected. Priority should be HIGH for deployments with Magic Link enabled in production, MEDIUM for staged rollouts, LOW for installations using alternative authentication methods. The Changed scope in CVSS correctly captures that memory exhaustion can impact other authentication flows sharing the same JVM instance.

An attacker identifies a WSO2 Identity Server deployment using Magic Link authentication by observing the authentication flow or endpoint responses. They script repeated POST requests to the Magic Link authentication endpoint with intentionally invalid or malformed magic link tokens, authentication session IDs, or user identifiers. Each invalid request triggers memory allocation for request processing, session tracking, or error handling without corresponding deallocation. After 10,000-100,000 requests (depending on available heap memory and request payload size), the authentication service exhausts available memory, triggering garbage collection storms, unresponsive authentication endpoints, and eventual service crash requiring manual restart.