Is CVE-2025-10908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10908 being exploited in the wild.

How severe is CVE-2025-10908?

High severity, with a CVSS score of 7.3, published 11 May 2026.

Which products and versions are affected?

Wso2 Identity Server 6.0.0 before update 249, 6.1.0 before update 248, 7.0.0 before update 124, 7.1.0 before update 31, 7.1.0, 7.0.0, 6.1.0, 6.0.0.

Is there a fix for CVE-2025-10908?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-10908 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-10908?

Check whether you run Wso2 Identity Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10908: WSO2 Identity Server account lock bypass in Magic Link and Passkey

CVE-2025-10908 · Severity: high · CVSS 7.3 · Published 2026-05-11

WSO2 Identity Server, a platform used for managing user identities and access to corporate applications, contains a flaw that allows locked user accounts to remain accessible. Specifically, users can bypass account locks by logging in using 'Magic Links' or 'Passkeys' instead of traditional passwords. This means an account that was intentionally disabled due to security concerns or employee termination could still be used to access sensitive company data and applications.

Technologies: Wso2 Identity Server. Vendors: Wso2.

Quick answers

Is CVE-2025-10908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10908 being exploited in the wild.
How severe is CVE-2025-10908?: High severity, with a CVSS score of 7.3, published 11 May 2026.
Which products and versions are affected?: Wso2 Identity Server 6.0.0 before update 249, 6.1.0 before update 248, 7.0.0 before update 124, 7.1.0 before update 31, 7.1.0, 7.0.0, 6.1.0, 6.0.0.
Is there a fix for CVE-2025-10908?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10908 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-10908?: Check whether you run Wso2 Identity Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in WSO2 Identity Server due to a lack of user account state validation during specific authentication flows. While traditional password-based logins may correctly respect an 'account locked' status, the Magic Link and Passkey authenticators fail to check this state before granting access. A remote attacker or a user with a locked account can successfully authenticate if they have access to these alternative login methods. This bypasses the intended security control designed to prevent access to restricted accounts. Fixes are available via WSO2 update levels or public GitHub pull requests for community users.

Affected products

WSO2 Identity Server 6.0.0 before update 249, 6.1.0 before update 248, 7.0.0 before update 124, 7.1.0 before update 31

Timeline

2026-01-26: advisory: Initial vendor advisory published by WSO2
2026-05-11: disclosed: CVE published to NVD

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4388/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.