This vulnerability (CWE-863) in WSO2 Identity Server occurs because the system does not properly validate the locked state of user accounts during authentication when using Magic Link or Pass Key methods. As a result, accounts that should be locked and inaccessible can still be authenticated, bypassing the intended security control. The affected versions include 6.0.0, 6.1.0, 7.0.0, and 7.1.0. The CVSS v3.1 base score is 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

The vulnerability allows attackers to bypass the account lock mechanism, potentially gaining unauthorized access to user accounts that should be locked. This can lead to unauthorized access to applications and sensitive data associated with those accounts. The integrity and availability of the affected system may also be impacted due to this bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Organizations using affected versions should monitor vendor communications for updates and consider restricting or disabling Magic Link and Pass Key authentication methods until a fix is available.