CVE-2025-10908 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "6.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThan": "6.0.0.249",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThan": "6.1.0.248",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.124",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1.0",
        "lessThan": "7.1.0.31",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon MagicLink Authenticator Module",
    "packageName": "org.wso2.carbon.identity.local.auth.magiclink:org.wso2.carbon.identity.application.authenticator.magiclink",
    "versions": [
      {
        "status": "affected",
        "version": "1.1.0",
        "lessThan": "1.1.0.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.1.5",
        "lessThan": "1.1.5.2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.1.22",
        "lessThan": "1.1.22.5",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.1.31",
        "lessThan": "1.1.31.2",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.1.43",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]