CVE-2026-55789
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Logto before version 1.41.0 has an XML injection vulnerability in SAML, where user-controlled profile attributes (e.g., name, email) are substituted into a SAML template without proper escaping. An authenticated low-privilege user can inject XML markup into a profile attribute, forging SAML attributes like role, leading to privilege escalation in relying service providers.
Risk Assessment
The organization faces a risk of privilege escalation by an authenticated user who can gain access to resources or functions reserved for higher roles in external services that trust SAML attributes.
Recommendation
Immediately upgrade Logto to version 1.41.0 or later, which includes a fix that prevents XML injection during SAML response generation.
Other vulnerabilities in Logto
See all- CVE-2026-15617Critical
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
- CVE-2026-15616Critical
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
- CVE-2026-15612Critical
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
- CVE-2026-15611Critical
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
- CVE-2026-82263Medium
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
- CVE-2026-82262Medium
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
- CVE-2026-63187Medium
Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.
- CVE-2026-62317High
Logto before version 1.41.0 has a catastrophic backtracking vulnerability in the regular expression used for email subaddressing blocking. An attacker can send a specially crafted email address, causing an event-loop stall and making authentication services unavailable.
- CVE-2026-15615High
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
- CVE-2026-15614High
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
Original NVD description (English source)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders unescaped. An authenticated low-privilege user could place XML markup in a profile attribute so Logto signed a forged SAML attribute, such as an arbitrary role, allowing privilege escalation at relying Service Providers that authorize on SAML attributes. This issue is fixed in version 1.41.0.