Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2025-10470: Magic Link Authentication Can Crash Server with Many Bad Login Attempts
CVE-2025-10470 · published 5 months ago
Summary
The Magic Link login process in some systems can run out of memory if it's attacked with many bad login attempts. This can make the system unavailable. To protect your system, you should limit the number of bad login attempts and monitor your system's memory usage.
Original advisory text
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.
This vulnerabil...
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.
This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.
This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published11 May 2026
Updated31 Oct 2026
First seen11 May 2026
Sources
CVE-2025-10470 · NVD
Track software like this
Free during beta