Threat Intelligence Database

CVE-2026-55789 is an XML Injection vulnerability in logto-io's logto product prior to version 1.41.0. The issue arises because the self-hosted SAML IdP component uses unsafe string substitution of user-controlled profile attributes into a SAML XML template without escaping. This allows an authenticated low-privilege user to inject XML markup into profile attributes, resulting in forged signed SAML attributes such as arbitrary roles. This can lead to privilege escalation at relying Service Providers that authorize based on SAML attributes. The vulnerability is fixed in version 1.41.0.

CVE-2026-55377 is an improper authentication vulnerability in logto-io's Logto product prior to version 1.41.0. The issue arises because the Account Center step-up check accepted any active verification record with isVerified set to true for the current user. This allowed an attacker with an existing Account API bearer token to create and verify a WebAuthn registration verification record and bypass proper authentication checks. As a result, the attacker could manage MFA factors without proving possession of a password, identifier, or existing MFA factor. The vulnerability is fixed in version 1.41.0.

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window = 1 and did not persist or compare the accepted TOTP time-step counter. An attacker who has the victim's first factor and captures a live TOTP value can replay that value to satisfy MFA during the same acceptance window. This issue is fixed in version 1.41.0.