CVE-2025-10908High· 7.3▾ TwilightDue to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked.
This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.
identity_server >= 6.0.0, < 6.0.0.249identity_server >= 6.1.0, < 6.1.0.248identity_server >= 7.0.0, < 7.0.0.124identity_server >= 7.1.0, < 7.1.0.31Upgrade past the affected range:
identity_server 7.1.0.31Connected by shared product, vendor, weakness, or advisory.
CVE-2025-9973Medium· 6.4Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations
CVE-2025-10470High· 8.6The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service co…
CVE-2025-0209Medium· 6.1A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding
CVE-2025-10503Medium· 6.1The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding
CVE-2025-12624Medium· 6.0Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server
CVE-2025-14779Low· 3.8The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type