CVE-2026-55377
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Logto prior to version 1.41.0 has a vulnerability in the step-up verification mechanism in Account Center. An attacker with an API token can create and verify a WebAuthn registration for a new passkey, then use it as identity verification, allowing MFA factor management without possessing a password, identifier, or existing MFA factor.
Risk Assessment
The organization is at risk of unauthorized addition or removal of MFA factors by an attacker who has obtained an API token. This could lead to account takeover and compromise of multi-factor authentication security.
Recommendation
Immediately upgrade Logto to version 1.41.0 or later. After upgrading, reset all API tokens and force re-verification of users.
Other vulnerabilities in Logto
See all- CVE-2026-15617Critical
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
- CVE-2026-15616Critical
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
- CVE-2026-15612Critical
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
- CVE-2026-15611Critical
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
- CVE-2026-82263Medium
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
- CVE-2026-82262Medium
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
- CVE-2026-63187Medium
Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.
- CVE-2026-62317High
Logto before version 1.41.0 has a catastrophic backtracking vulnerability in the regular expression used for email subaddressing blocking. An attacker can send a specially crafted email address, causing an event-loop stall and making authentication services unavailable.
- CVE-2026-15615High
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
- CVE-2026-15614High
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
Original NVD description (English source)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the logto-verification-id header and treated as identityVerified=true by Account Center routes, allowing MFA factor management without proving possession of an existing password, identifier, or MFA factor. This issue is fixed in version 1.41.0.