Read the docs
TI-2026-44494 Aliases CVE-2026-62317

Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00742 54th percentileScored 2026-11-07
Fix Fixed logto (logto-io): 1.41.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
logto-iologtobefore 1.41.01.41.0Patch availableCNA
  • logto Vendorlogto-io Affected before 1.41.0 Fixed in 1.41.0 Patch available CNA

Remediation

  • Fix · CNA logto (logto-io) Fixed in 1.41.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62317

References

Other 4

  • TI-2026-40275 XML injection in logto-io logto CVSS 3.1HIGH 8.5
  • TI-2026-56728 Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL CVSS 4.0HIGH 8.2
  • TI-2026-39955 Logto: Account Center MFA management step-up bypass via WebAuthn registration verification CVSS 3.1HIGH 8.1
  • TI-2026-45089 Logto: Account API can disclose stored third-party provider tokens without the identities scope CVSS 3.1HIGH 7.6
  • TI-2026-45086 Logto: OS command injection vulnerability exists in the Commitlint workflow CVSS 3.1MEDIUM 6.3
  • TI-2026-45087 logto-tunnel serves files outside --experience-path via path traversal CVSS 4.0HIGH 8.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences