Logto versions before 1.41.0 contain an improper authentication vulnerability (CWE-287) where the Account Center step-up check incorrectly trusts any active verification record with isVerified === true belonging to the current user. An attacker possessing a valid Account API bearer token could create and verify a WebAuthn registration verification record, then use it in the logto-verification-id header to bypass authentication checks in Account Center routes. This allowed unauthorized management of MFA factors without proving possession of existing credentials or MFA factors. The vulnerability is addressed in version 1.41.0.

Successful exploitation allows an attacker with a valid Account API bearer token to bypass multi-factor authentication controls and manage MFA factors without proving possession of existing credentials or MFA factors. This compromises the authentication integrity of the affected Logto accounts, potentially leading to unauthorized account access and privilege escalation. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

Upgrade Logto to version 1.41.0 or later, where this improper authentication vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 1.41.0.