logto-io

Records11All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

logto-io records in CISA KEV

No logto-io vulnerabilities are listed in CISA KEV.

Records

11 records

TI-2026-44494 CVE-2026-62317

Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)

HIGH 72

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00742 Published 2026-08-19 Fixed in 1.41.0 CWE-1333

TI-2026-40275 CVE-2026-55789

XML injection in logto-io logto

HIGH 70

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00344 Published 2026-07-10 Fixed in 1.41.0 CWE-1395

TI-2026-56728 CVE-2026-82263 · GHSA-2c8c-r4jf-gp34

Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

HIGH 69

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00459 Published 2026-08-28 No fix listed CWE-918

TI-2026-39955 CVE-2026-55377

Logto: Account Center MFA management step-up bypass via WebAuthn registration verification

HIGH 68

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00401 Published 2026-07-10 Fixed in 1.41.0 CWE-287

TI-2026-45089 CVE-2026-63203

Logto: Account API can disclose stored third-party provider tokens without the identities scope

HIGH 66

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00311 Published 2026-09-24 Fixed in 1.42.0 CWE-862

TI-2026-45086 CVE-2026-63187

Logto: OS command injection vulnerability exists in the Commitlint workflow

MEDIUM 61

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.0039 Published 2026-08-19 Fixed in 1.41.0 CWE-94

TI-2026-45087 CVE-2026-63188 · GHSA-rxjr-6c9q-h67x

logto-tunnel serves files outside --experience-path via path traversal

MEDIUM 44

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0054 Published 2026-08-19 Fixed in 0.3.9 CWE-22

TI-2026-40912 CVE-2026-56739

Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint

LOW 37

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00296 Published 2026-09-24 Fixed in 1.43.0 CWE-918

TI-2026-56727 CVE-2026-82262 · GHSA-2442-5g74-2q7v

Logto Server-Side Request Forgery via webhook test endpoint

LOW 36

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00459 Published 2026-08-28 No fix listed CWE-918

TI-2026-39950 CVE-2026-55370

Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)

LOW 30

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00336 Published 2026-07-10 Fixed in 1.41.0 CWE-294

TI-2026-39528 CVE-2026-54714

Logto: XSS via unescaped RelayState in SAML auto-submit form

LOW 27

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00338 Published 2026-07-10 Fixed in 1.41.0 CWE-79

Open these records in search →

Critical	0
High	8
Medium	3
Low	0
No CVSS	0