Skip to content
Logto-io Logto vulnerabilities
-
logto-io logto
Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
CVE-2026-56739
8.5 High
-
logto-io logto
Logto: Account API can disclose stored third-party provider tokens without the identities scope
CVE-2026-63203
7.6 High
-
logto-io logto
Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
CVE-2026-82263
8.2 High
-
logto-io logto
Logto Server-Side Request Forgery via webhook test endpoint
CVE-2026-82262
8.2 High
-
logto-io logto
Logto: OS command injection vulnerability exists in the Commitlint workflow
CVE-2026-63187
6.3 Medium
-
logto-io logto
logto-tunnel serves files outside --experience-path via path traversal
CVE-2026-63188
Fix available
8.7 High
-
logto-io logto
Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
CVE-2026-62317
7.5 High
-
logto
Unverified email-based SSO account linking
CVE-2026-15611
9.1 Critical
-
logto
LOIDC nonce validation bypass
CVE-2026-15612
9.1 Critical
-
logto
IdP-initiated SAML sessions not reliably invalidated (replay)
CVE-2026-15614
7.5 High
-
logto
SAML <Conditions> element not validated
CVE-2026-15615
7.5 High
-
logto
Local MFA not enforced during SSO sign-in
CVE-2026-15616
9.1 Critical
-
logto
Principal/domain lookup without case normalization
CVE-2026-15617
9.1 Critical
-
logto-io logto
Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
CVE-2026-55377
8.1 High
-
logto-io logto
Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
CVE-2026-55370
6.4 Medium
-
logto-io logto
Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers
CVE-2026-55789
8.5 High
-
logto-io logto
Logto: XSS via unescaped RelayState in SAML auto-submit form
CVE-2026-54714
6.1 Medium