An unauthenticated resource exhaustion vulnerability in the Magic Link authentication flow poses a significant risk of denial-of-service to affected systems.

This is a resource exhaustion vulnerability caused by improper rate limiting within the Magic Link authentication mechanism. Attackers can trigger uncontrolled memory growth by submitting numerous invalid authentication requests, which does not require prior authentication.

The successful exploitation of this vulnerability can result in significant system downtime and service unavailability, directly impacting business continuity. With a CVSS score of 8.6, this flaw represents a high-severity risk that could be leveraged by malicious actors to disrupt critical authentication services.

Immediate Action: Identify all services utilizing the vulnerable Magic Link authentication flow and apply vendor-supplied patches or updates as soon as they become available.

Proactive Monitoring: Monitor system memory usage and authentication logs for spikes in failed login attempts or anomalous request patterns targeting the authentication endpoint.

Compensating Controls: Implement strict rate limiting and request throttling at the Web Application Firewall (WAF) or load balancer level to mitigate the impact of malicious request flooding.

Public Exploit Available: false

Given the potential for service disruption, organizations should prioritize auditing their authentication infrastructure to determine if they are utilizing the affected software. Apply vendor security updates immediately upon release to remediate the underlying lack of rate limiting.