Logto vulnerabilities

Logto from 1.31.0 to 1.42.0 has a vulnerability in the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts that allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary.

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

Logto before version 1.43.0 fetches administrator-controlled outbound destinations without validating the connection address. Webhook delivery and custom/OIDC connectors can reach special-use and cloud metadata addresses, potentially exposing internal data or upstream provider credentials. This issue is fixed in version 1.43.0.

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.

Logto before version 1.41.0 has a catastrophic backtracking vulnerability in the regular expression used for email subaddressing blocking. An attacker can send a specially crafted email address, causing an event-loop stall and making authentication services unavailable.

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Logto before version 1.41.0 has an XML injection vulnerability in SAML, where user-controlled profile attributes (e.g., name, email) are substituted into a SAML template without proper escaping. An authenticated low-privilege user can inject XML markup into a profile attribute, forging SAML attributes like role, leading to privilege escalation in relying service providers.

Logto prior to version 1.41.0 has a vulnerability in the step-up verification mechanism in Account Center. An attacker with an API token can create and verify a WebAuthn registration for a new passkey, then use it as identity verification, allowing MFA factor management without possessing a password, identifier, or existing MFA factor.

Logto prior to version 1.41.0 has a vulnerability in TOTP verification that allows reusing the same TOTP code within the RFC 6238 acceptance window. An attacker who knows the first authentication factor and captures a live TOTP code can replay it to bypass MFA.

A vulnerability in Logto prior to 1.41.0 allows script injection (XSS) by reflecting unsanitized SAML RelayState, SAMLResponse, or actionUrl parameters into an HTML form. An attacker can craft a malicious SAML request to execute arbitrary JavaScript in the Logto tenant origin after user login.