Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-10908 Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. Thi… https://www.cve.org/CVERecord?id=CVE-2025-10908
Post summary
The post announces CVE‑2025‑10908, detailing an authentication bypass that lets locked accounts be accessed via Magic Link or Pass Key, with no PoC, exploit, or mitigation information provided.
CVE-2025-10908 Authentication Bypass in Magic Link and Pass Key Methods via Locked Acco... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-10908 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet announces CVE-2025-10908, an authentication bypass affecting magic link and pass key methods, but provides no proof‑of‑concept, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wso2 | identity_server | - | - | - |