Logto versions >=1.31.0 and <1.42.0 contain a missing authorization vulnerability (CWE-862) in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. Specifically, callers with a same-user access token scoped only with openid can access endpoints GET /api/my-account/identities/{target}/access-token and GET /api/my-account/sso-identities/{connectorId}/access-token to retrieve stored social or enterprise SSO provider access tokens. These handlers authenticate the user but do not enforce the identities scope, which is required to protect related identity-detail operations, thereby bypassing the intended consent boundary. Exploitation requires that federated token-set storage is enabled and that the user has authenticated via a supported connector. A low-trust application could misuse the disclosed provider token against upstream APIs within the token's granted scopes. The vulnerability is resolved in version 1.42.0.

An attacker with a same-user access token limited to the openid scope can retrieve stored third-party access tokens without proper authorization. This can lead to unauthorized access to upstream APIs within the scope of the disclosed tokens, potentially exposing sensitive information or allowing actions on behalf of the user. The vulnerability does not affect availability but impacts confidentiality and partially integrity.

Upgrade to logto version 1.42.0 or later, where this missing authorization issue is fixed. There is no indication that temporary mitigations are available. Users should ensure federated token-set storage is configured securely and review access token scopes. Patch status is confirmed fixed in 1.42.0.