Logto-io vulnerabilities
We track 6 vulnerabilities in Logto-io products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.
Latest Logto-io vulnerabilities
- 7.6 High severity
logto: Missing Authorization
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope t
- 8.5 High severity
logto: Server-Side Request Forgery
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hoo
- 8.7 High severity
logto: Improper Limitation of a Pathname to a Restricted Directory
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through pa
- 7.5 High severity
logto: Inefficient Regular Expression Complexity
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input t
- 8.5 High severity
logto: XML Injection
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and
- 8.1 High severity
logto: Improper Authentication
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration veri