Logto Account Center MFA Step-Up Bypass via WebAuthn Registration Verification (CWE-287)

Vulnerability Overview Title: Account Center MFA management step-up bypass via WebAuthn registration verification Description: Summary: Logto's Account Center step-up check accepts any verification record belonging to the current user with . A WebAuthn registration verification record can be created and validated using an existing Account API bearer token without first authenticating the user. Once validated, the newly registered record can be sent in the header and treated by the Account Center routing as . This allows a malicious user who has hijacked a user session/token to initiate their own step-up process for required Account API scopes, thereby managing MFA factors without proving ownership of existing passwords, identifiers, or MFA factors. Affected paths: - Step-up derivation: - WebAuthn registration verification record creation: - WebAuthn verification record semantics: - Account Center MFA management: Root cause: - derives by loading the client-controlled header and returning if the record belongs to the authenticated user. This merges different verification purposes into a single boolean value. - Validating a WebAuthn registration record only implies that the browser has completed the new credential registration ritual; it does not prove that the current operator has re-authenticated using existing account credentials or existing MFA factors. The Account Center step-up gate should only accept verification records for the user permission validation purpose. Exploit outline: - Preconditions: - The attacker can obtain the victim's Account API bearer token. - The token has and Account API scopes for identity/MFA management, such as . - Account Center is enabled and MFA fields are editable. - Steps: 1. Call using the victim's bearer token to create a WebAuthn registration verification record. 2. Complete using an attacker-controlled passkey/authenticator. The verification record is now and belongs to the victim user. 3. Send an Account Center request with the header , allowing sensitive Account Center MFA operations. 4. sets . 5. The attacker can add an attacker-controlled MFA factor or remove existing MFA factors via . Impact: - An attacker who has hijacked a valid user session/token can bypass the Account Center step-up re-authentication for MFA factor management. This allows the attacker to delete the victim's existing MFA factors and bind attacker-controlled alternatives, thereby enhancing persistence and weakening the legitimate user's ability to recover their account. - Classified as CWE-287, Improper Authentication. The suggested CVSS 3.1 score is 8.1 High. Affected Versions Package: (npm) Affected versions: Patched versions: Remediation Remediation: - Keep as a gate for sensitive Account Center operations, but restrict which verification records can generate it. Step-up derivation should only accept verification records intended for user permission validation, such as: - Validated password verification records; - Validated email/phone code records created with . - New MFA binding records, WebAuthn registration records, MFA verification records, passkey records, or other records whose status indicates something other than user permission validation should not be accepted. - A local fix has been prepared on the branch , commit (fix(core): restrict account center step-up verification). This fix restricts to user permission validation records and adds regression test cases, including successful password/code validation and rejection of WebAuthn registration and BindMFA. Validation: - Local validation was performed on the prepared fix: POC Code No specific POC code was provided in the source; however, the exploitation steps are described above.

Goal Reached Thanks to every supporter — we hit 100%!

Logto Account Center MFA Step-Up Bypass via WebAuthn Registration Verification (CWE-287)

More from this source