CVE-2026-55377 | Logto is the modern, open-source auth infrastructure for Saa… | CVSS 8.1 HIGH

Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the logto-verification-id header and treated as identityVerified=true by Account Center routes, allowing MFA factor management without proving possession of an existing password, identifier, or MFA factor. This issue is fixed in version 1.41.0.

Metadata

CVE ID: CVE-2026-55377
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 18:57 UTC
Published: 2026-07-10 19:57 UTC
Last updated: 2026-07-10 19:57 UTC
Primary CWE: CWE-287
CWE-287: Improper Authentication
Vendor / Product: logto-io / logto
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products (1)

Vendor	Product	Platform	Versions
logto-io	logto	—	< 1.41.0

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287: Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References (4)

https://github.com/logto-io/logto/security/advisories/GHSA-q4h3-38gc-4p4j https://github.com/logto-io/logto/security/advisories/GHSA-q4h3-38gc-4p4j
https://github.com/logto-io/logto/pull/9110 https://github.com/logto-io/logto/pull/9110
https://github.com/logto-io/logto/commit/f56255a7edf3b22b0ec2fdb814814ce6b0123b74 https://github.com/logto-io/logto/commit/f56255a7edf3b22b0ec2fdb814814ce6b0123b74
https://github.com/logto-io/logto/releases/tag/v1.41.0 https://github.com/logto-io/logto/releases/tag/v1.41.0