A critical resource consumption vulnerability in the WSO2 Magic Link authentication flow allows unauthenticated attackers to trigger a denial-of-service by exhausting system memory.

The application lacks adequate rate limiting (CWE-400) for incoming authentication requests. An unauthenticated attacker can submit a high volume of invalid requests, causing the system to consume excessive memory and ultimately leading to service unavailability.

Rated at CVSS 8.6, this vulnerability poses a significant risk to the availability of identity services. A successful denial-of-service attack could prevent legitimate users from authenticating, effectively halting business operations that rely on the affected WSO2 infrastructure.

Immediate Action: Upgrade the WSO2 Carbon MagicLink Authenticator Module to version 1.1.31 or higher and follow the specific guidance provided in the vendor security advisory.

Proactive Monitoring: Monitor system memory usage and authentication request rates to identify spikes indicative of a potential denial-of-service attack.

Compensating Controls: Implement rate limiting at the network or API gateway layer to throttle incoming authentication requests before they reach the vulnerable service.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates prompt action to stabilize the identity environment. Administrators should apply the vendor-provided updates immediately and consider implementing temporary rate-limiting controls if an immediate upgrade is not feasible.