CVE-2026-55370
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Logto prior to version 1.41.0 has a vulnerability in TOTP verification that allows reusing the same TOTP code within the RFC 6238 acceptance window. An attacker who knows the first authentication factor and captures a live TOTP code can replay it to bypass MFA.
Risk Assessment
The risk is that an attacker can bypass multi-factor authentication (MFA), potentially leading to unauthorized access to user accounts and sensitive data.
Recommendation
It is recommended to immediately upgrade Logto to version 1.41.0 or later, which includes a fix preventing TOTP code reuse.
Other vulnerabilities in Logto
See all- CVE-2026-15617Critical
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
- CVE-2026-15616Critical
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
- CVE-2026-15612Critical
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
- CVE-2026-15611Critical
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
- CVE-2026-82263Medium
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
- CVE-2026-82262Medium
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
- CVE-2026-63187Medium
Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.
- CVE-2026-62317High
Logto before version 1.41.0 has a catastrophic backtracking vulnerability in the regular expression used for email subaddressing blocking. An attacker can send a specially crafted email address, causing an event-loop stall and making authentication services unavailable.
- CVE-2026-15615High
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
- CVE-2026-15614High
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
Original NVD description (English source)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window = 1 and did not persist or compare the accepted TOTP time-step counter. An attacker who has the victim's first factor and captures a live TOTP value can replay that value to satisfy MFA during the same acceptance window. This issue is fixed in version 1.41.0.