Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

logto — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in logto, with AI-generated Chinese analysis, references, and POCs.

This page is a vulnerability aggregation resource for Logto, an open-source identity and access management solution, focusing on common weakness types such as authentication flaws and injection vulnerabilities. It collects security reports and advisory notices related to Logto, covering a comprehensive time range from its initial public releases to the most recent updates. Readers can use this centralized hub to track vendor advisories as they are published, allowing them to stay informed about emerging risks without navigating multiple disparate sources. The interface also enables users to understand specific weakness classes by aggregating related issues under standardized taxonomy labels, providing context on how these flaws manifest within the Logto ecosystem. Furthermore, individuals can look up the product’s vulnerability history to assess the evolution of its security posture over time. This historical perspective helps security teams evaluate the stability of the software and the effectiveness of past mitigation efforts. The page serves as a reference for developers, security analysts, and system administrators who need to quickly identify potential threats associated with Logto implementations. By consolidating this information, the page reduces the friction involved in monitoring a single product’s security landscape. It aims to provide clarity and speed in decision-making processes related to patching and risk assessment. All entries are structured to facilitate easy searching and filtering based on severity, release date, or weakness type. This approach ensures that users can efficiently locate the specific data points relevant to their current operational needs.

Vendor: logto-io

CVE ID Title CVSS Severity Published
CVE-2026-56739 Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint CWE-918 8.5 High 2026-09-24
CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope CWE-862 7.6 High 2026-09-24
CVE-2026-82263 Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL CWE-918 6.8 Medium 2026-08-28
CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint CWE-918 6.8 Medium 2026-08-28
CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow CWE-94 6.3 Medium 2026-08-19
CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal CWE-22 8.7 High 2026-08-19
CVE-2026-62317 Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing) CWE-1333 7.5 High 2026-08-19
CVE-2026-15611 Unverified email-based SSO account linking - - 2026-07-23
CVE-2026-15612 LOIDC nonce validation bypass - - 2026-07-23
CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay) - - 2026-07-23
CVE-2026-15615 SAML <Conditions> element not validated - - 2026-07-23
CVE-2026-15616 Local MFA not enforced during SSO sign-in - - 2026-07-23
CVE-2026-15617 Principal/domain lookup without case normalization - - 2026-07-23
CVE-2026-55377 Logto: Account Center MFA management step-up bypass via WebAuthn registration verification CWE-287 8.1 High 2026-07-10
CVE-2026-55370 Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation) CWE-294 6.4 Medium 2026-07-10
CVE-2026-55789 Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers CWE-91 8.5 High 2026-07-10
CVE-2026-54714 Logto: XSS via unescaped RelayState in SAML auto-submit form CWE-79 6.1 Medium 2026-07-10

All 17 known CVE vulnerabilities affecting logto with full Chinese analysis, references, and POCs where available.