Logto-io vulnerabilities

Products

• Logto 17

Newest

• logto-io logto Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint CVE-2026-56739 8.5 HighSeptember 24, 2026
• logto-io logto Logto: Account API can disclose stored third-party provider tokens without the identities scope CVE-2026-63203 7.6 HighSeptember 24, 2026
• logto-io logto Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL CVE-2026-82263 8.2 HighAugust 28, 2026
• logto-io logto Logto Server-Side Request Forgery via webhook test endpoint CVE-2026-82262 8.2 HighAugust 28, 2026
• logto-io logto Logto: OS command injection vulnerability exists in the Commitlint workflow CVE-2026-63187 6.3 MediumAugust 19, 2026
• logto-io logto logto-tunnel serves files outside --experience-path via path traversal CVE-2026-63188 Fix available 8.7 HighAugust 19, 2026
• logto-io logto Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing) CVE-2026-62317 7.5 HighAugust 19, 2026
• logto Unverified email-based SSO account linking CVE-2026-15611 9.1 CriticalJuly 23, 2026
• logto LOIDC nonce validation bypass CVE-2026-15612 9.1 CriticalJuly 23, 2026
• logto IdP-initiated SAML sessions not reliably invalidated (replay) CVE-2026-15614 7.5 HighJuly 23, 2026
• logto SAML <Conditions> element not validated CVE-2026-15615 7.5 HighJuly 23, 2026
• logto Local MFA not enforced during SSO sign-in CVE-2026-15616 9.1 CriticalJuly 23, 2026
• logto Principal/domain lookup without case normalization CVE-2026-15617 9.1 CriticalJuly 23, 2026
• logto-io logto Logto: Account Center MFA management step-up bypass via WebAuthn registration verification CVE-2026-55377 8.1 HighJuly 10, 2026
• logto-io logto Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation) CVE-2026-55370 6.4 MediumJuly 10, 2026
• logto-io logto Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers CVE-2026-55789 8.5 HighJuly 10, 2026
• logto-io logto Logto: XSS via unescaped RelayState in SAML auto-submit form CVE-2026-54714 6.1 MediumJuly 10, 2026