« Volver al listado

CVE-2025-10908

Estado: AnalizadaAlta (7.3)—

Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked.

This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de autenticación en servicio remoto (WSO2 Identity Server) sin requerir autenticación previa (PR:N, UI:N). Permite eludir el bloqueo de cuentas para obtener acceso válido (T1078) y potencial control de identidad (T1556).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUser Account ManagementPassword PoliciesMulti-factor AuthenticationApplication Developer GuidanceActive Directory Configuration

Tecnologías afectadas (1)

Wso2 — Identity Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-10908",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-10908",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-11T18:37:41.307369Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server",
          "versions": [
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "6.0.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.0.0.249",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "lessThan": "6.1.0.248",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.0.0.124",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.1.0",
              "lessThan": "7.1.0.31",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "WSO2",
          "product": "WSO2 Carbon MagicLink Authenticator Module",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0",
              "lessThan": "1.1.0.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.1.5",
              "lessThan": "1.1.5.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.1.22",
              "lessThan": "1.1.22.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.1.31",
              "lessThan": "1.1.31.2",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.1.43",
              "versionType": "custom",
              "lessThanOrEqual": "*"
            }
          ],
          "packageName": "org.wso2.carbon.identity.local.auth.magiclink:org.wso2.carbon.identity.application.authenticator.magiclink",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-05-11T10:16:12.590",
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4388/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked.\n\nThis vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts."
    }
  ],
  "lastModified": "2026-06-17T08:29:15.273",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E34A030-0542-4D6D-B6AB-84120126F978",
              "versionEndExcluding": "6.0.0.249",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11004AEC-A44F-43EF-BBB9-EDEB656370D0",
              "versionEndExcluding": "6.1.0.248",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6DD077D-36D9-4B1F-8D13-869EA0FE3030",
              "versionEndExcluding": "7.0.0.124",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A354D72-7106-4EC6-8CF8-F13053461B17",
              "versionEndExcluding": "7.1.0.31",
              "versionStartIncluding": "7.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}