logto-io logto vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Latest logto-io logto vulnerabilities

CVE-2026-63203 — Logto: Account API can disclose stored third-party provider tokens without the identities scope (CVSS 7.6)
CVE-2026-56739 — Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint (CVSS 8.5)
CVE-2026-82263 — Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL (CVSS 6.8)
CVE-2026-82262 — Logto Server-Side Request Forgery via webhook test endpoint (CVSS 6.8)
CVE-2026-63188 — logto-tunnel serves files outside --experience-path via path traversal (CVSS 8.7)
CVE-2026-63187 — Logto: OS command injection vulnerability exists in the Commitlint workflow (CVSS 6.3)
CVE-2026-62317 — Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing) (CVSS 7.5)
CVE-2026-55789 — Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers (CVSS 8.5)
CVE-2026-55377 — Logto: Account Center MFA management step-up bypass via WebAuthn registration verification (CVSS 8.1)
CVE-2026-55370 — Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation) (CVSS 6.4)
CVE-2026-54714 — Logto: XSS via unescaped RelayState in SAML auto-submit form (CVSS 6.1)