The Magic Link authentication flow accepts multiple invalid authentication requests without any form of rate limiting or resource control, which causes memory usage to grow unbounded. This resource exhaustion can lead to a denial‑of‑service condition, rendering the affected instance unavailable. The weakness is a classic instance of CWE‑400, where improper handling of input leads to resource exhaustion.

The flaw affects the WSO2 Carbon MagicLink Authenticator Module and the WSO2 Identity Server, specifically deployments that enable Magic Link authentication. No specific version information is provided, so any installation that incorporates the Magic Link authenticator is potentially vulnerable.

The vulnerability carries a CVSS score of 8.6, indicating a high‑severity impact, and an EPSS score of less than 1%, suggesting that exploitation is uncommon but still possible. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an external entity sending repeated invalid authentication attempts to the Magic Link endpoint could enumerate memory usage growth and cause service unavailability. The attack does not require privileged access and does not directly lead to lateral movement or data exfiltration beyond the denial‑of‑service effect.