This vulnerability (CVE-2025-10470) in WSO2 Identity Server 7.0.0 involves uncontrolled resource consumption (CWE-400) due to inadequate rate limiting on the Magic Link authentication flow. Attackers can send multiple invalid authentication requests, causing memory usage to grow uncontrollably and potentially resulting in a denial-of-service condition. The impact is limited to deployments that utilize the Magic Link authenticator. The CVSS v3.1 score is 8.6 (high), reflecting network attack vector, no privileges or user interaction required, and a high impact on availability without affecting confidentiality or integrity. No patch or official remediation level has been published by WSO2 as of the data provided.

Successful exploitation can cause denial of service by exhausting memory resources on the affected WSO2 Identity Server 7.0.0 instances that use the Magic Link authentication flow. This results in service unavailability. There is no impact on confidentiality or integrity reported. The vulnerability requires repeated invalid authentication attempts and affects only specific deployments using the Magic Link authenticator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing external rate limiting or other resource controls on authentication requests to mitigate potential denial-of-service conditions. Monitoring for unusual authentication request patterns targeting the Magic Link flow may help detect exploitation attempts.