Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked.

This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 Identity Server unaffected
Version Status Constraints
0 unknown < 6.0.0
6.0.0 affected < 6.0.0.249
6.1.0 affected < 6.1.0.248
7.0.0 affected < 7.0.0.124
7.1.0 affected < 7.1.0.31
WSO2 WSO2 Carbon MagicLink Authenticator Module unknown
Version Status Constraints
1.1.0 affected < 1.1.0.1
1.1.5 affected < 1.1.5.2
1.1.22 affected < 1.1.22.5
1.1.31 affected < 1.1.31.2
1.1.43 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Wso2 Subscribe
Wso2 Carbon Magiclink Authenticator Module Subscribe
Wso2 Identity Server Subscribe
Advisories

No advisories yet.

Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4388/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4388/ cve-icon cve-icon
History

Mon, 11 May 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Mon, 11 May 2026 15:15:00 +0000

Type Values Removed Values Added
Description Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.
Title Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
First Time appeared Wso2
Wso2 wso2 Carbon Magiclink Authenticator Module
Wso2 wso2 Identity Server
Weaknesses CWE-863
CPEs cpe:2.3:a:wso2:wso2_carbon_magiclink_authenticator_module:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*
Vendors & Products Wso2
Wso2 wso2 Carbon Magiclink Authenticator Module
Wso2 wso2 Identity Server
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-05-11T18:38:02.953Z

Reserved: 2025-09-24T09:32:17.201Z

Link: CVE-2025-10908

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-11T10:16:12.590

Modified: 2026-05-11T20:23:28.213

Link: CVE-2025-10908

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-11T17:45:26Z

Weaknesses