{"id":"CVE-2025-10470","title":"The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.\n\nThis vulnerability can result in a denial-of-service co…","summary":"The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.\n\nThis vulnerability can result in a denial-of-service co…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"wso2","product":"identity_server","affected":["identity_server >= 7.0.0, < 7.0.0.121"],"patched":["identity_server 7.0.0.121"],"published":"2026-05-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-10470","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4469/","label":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"tags":["nvd"],"epss":0.00317,"epssPercentile":0.22827,"ingestedAt":"2026-10-14T13:30:58.493Z","slug":"CVE-2025-10470","body":"## Overview\n\nThe Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.\n\nThis vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.\n\n## Affected\n\n- `identity_server >= 7.0.0, < 7.0.0.121`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `identity_server 7.0.0.121`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}