CVE-2025-10908 - Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

CVE ID :CVE-2025-10908 Published : May 11, 2026, 10:16 a.m. | 49 minutes ago Description :Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security contr