Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55377— Logto: Account Center MFA management step-up bypass via WebAuthn registration verification

Quick assessment

Affected
logto-io logto
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

logto-io logto是logto-io组织的一个身份认证和用户管理平台。 logto-io logto 1.41.0之前版本存在授权问题漏洞，该漏洞源于Account Center身份验证检查逻辑问题，导致可仅通过现有Account API bearer token创建和验证WebAuthn注册验证记录，并在logto-verification-id标头中发送，从而允许在不提供现有密码、标识符或MFA因子的情况下管理MFA因子。

CVSS 8.1 · High EPSS 0.46% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
logto-io logto < 1.41.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55377

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
Source: CVE Program / CVE List V5
Vulnerability Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the logto-verification-id header and treated as identityVerified=true by Account Center routes, allowing MFA factor management without proving possession of an existing password, identifier, or MFA factor. This issue is fixed in version 1.41.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
logto-io logto 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
logto-io logto是logto-io组织的一个身份认证和用户管理平台。 logto-io logto 1.41.0之前版本存在授权问题漏洞，该漏洞源于Account Center身份验证检查逻辑问题，导致可仅通过现有Account API bearer token创建和验证WebAuthn注册验证记录，并在logto-verification-id标头中发送，从而允许在不提供现有密码、标识符或MFA因子的情况下管理MFA因子。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
logto-io logto < 1.41.0 -

II. Public POCs for CVE-2026-55377

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 10461 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55377

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55377 (2)

Vendor Advisories for CVE-2026-55377 (1)

Vendor Pages for CVE-2026-55377 (1)

Same Patch Batch · logto-io · 2026-07-10 · 4 CVEs total

CVE-2026-55789 8.5 HIGH Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, all
CVE-2026-55370 6.4 MEDIUM Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violati
CVE-2026-54714 6.1 MEDIUM Logto: XSS via unescaped RelayState in SAML auto-submit form

IV. Related Vulnerabilities

Same product: logto
Same vendor: logto-io
Same weakness: CWE-287

V. Comments for CVE-2026-55377

No comments yet

Leave a comment