Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63203— Logto: Account API can disclose stored third-party provider tokens without the identities scope

Quick assessment

Affected
logto-io logto
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Logto 是现代、开源的身份认证基础设施，适用于 SaaS 和 AI 应用。从版本 1.31.0 到 1.42.0， 中的账户 API 处理器存在安全漏洞：攻击者只要持有同一用户仅包含 范围的访问令牌，即可通过以下两个端点获取存储的社交或企业单点登录（SSO）提供者的访问令牌： 这些处理器虽然对用户进行了身份验证，但并未要求保护邻近身份详情操作所必需的 范围，从而绕过了预期的账户 API 同意边界。 利用该漏洞需满足以下条件： 启用了联合令牌集存储（federated token-set storage）； 受影

CVSS 7.6 · High EPSS 0.31% · P22

Affected Version Matrix 1

VendorProduct Version RangeStatus
logto-io logto >= 1.31.0, < 1.42.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63203

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Logto: Account API can disclose stored third-party provider tokens without the identities scope
Source: CVE Program / CVE List V5
Vulnerability Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
logto-io logto >= 1.31.0, < 1.42.0 -

II. Public POCs for CVE-2026-63203

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63203

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63203 (2)

Vendor Advisories for CVE-2026-63203 (1)

Vendor Pages for CVE-2026-63203 (1)

IV. Related Vulnerabilities

Same product: logto
Same vendor: logto-io
Same weakness: CWE-862

V. Comments for CVE-2026-63203

No comments yet

Leave a comment