WSO2 Identity Server Magic Link Authentication Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in WSO2 Identity Server version 7.0.0, specifically within the Magic Link authentication flow. This issue arises because the authentication process allows multiple invalid requests without proper rate limiting or resource management. As a result, memory usage can grow uncontrollably, leading to service unavailability. The vulnerability requires repeated invalid authentication attempts to be exploited.

Impact

Exploitation of this vulnerability can cause the authentication mechanism to become completely unavailable, disrupting access for legitimate users.

Remediation

Users can apply the public fix available on the WSO2 GitHub repository for the Magic Link authentication extension. For WSO2 Identity Server support subscription holders, the recommended update is to version 7.0.0, update level 121.