Executive brief
WSO2 Identity Server, a platform used for managing user identities and access to corporate applications, contains a flaw that allows locked user accounts to remain accessible. Specifically, users can bypass account locks by logging in using 'Magic Links' or 'Passkeys' instead of traditional passwords. This means an account that was intentionally disabled due to security concerns or employee termination could still be used to access sensitive company data and applications.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in WSO2 Identity Server due to a lack of user account state validation during specific authentication flows. While traditional password-based logins may correctly respect an 'account locked' status, the Magic Link and Passkey authenticators fail to check this state before granting access. A remote attacker or a user with a locked account can successfully authenticate if they have access to these alternative login methods. This bypasses the intended security control designed to prevent access to restricted accounts. Fixes are available via WSO2 update levels or public GitHub pull requests for community users.
Affected products
- WSO2 Identity Server 6.0.0 before update 249, 6.1.0 before update 248, 7.0.0 before update 124, 7.1.0 before update 31
Timeline
- 2026-01-26: advisory: Initial vendor advisory published by WSO2
- 2026-05-11: disclosed: CVE published to NVD