Magic Link
A passwordless login where the user clicks a one-time link sent to their email. Simple to ship but inherits email security and deliverability limits, and is not phishing-resistant.
Magic links trade one credential for another: the account is now exactly as secure as the mailbox, and the mailbox is the single most attacked account a person has. They also break in ordinary ways, through link scanners that consume the token, corporate mail rewriting, and cross-device flows where the link opens in the wrong browser. Fine as a low-friction option, wrong as the only path for anything valuable.
See also: what is passwordless, passkey, social login, CIAM vendors
Related on Start with Identity
- GlossaryLocal Login Bypass
A local login bypass is any way into an SSO-protected application that does not go through the identity provider: an owner or admin account that keeps a passwor
- GlossaryProgressive Profiling
Collecting user profile data gradually over multiple interactions rather than in one long signup form, to reduce friction and improve conversion in customer ide
- GlossaryAccount Recovery
The process by which a user regains access after losing their authenticator: a lost device, a forgotten password, or a revoked credential. It is a parallel auth
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla
- BlogA shared ChatGPT link could read the victim's session token and private chats, Parameter says
Parameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's A
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct