CVE-2026-119420

34th percentile - higher than 34% of all known CVEs

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

An organization administrator can take over another user's account and gain access to confidential data and payment integrations. This may lead to financial fraud and data leakage.

Update Lago to a version newer than 1.55.0. Until then, restrict organization administrator privileges and monitor for unusual invitation acceptances.