Threats tagged 'ghsa-gvqv-g6vj-p22g'

Lago versions through 1.55.0 have an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts without password verification. This occurs via the acceptInvite mutation, enabling attackers to accept an invitation with any password and receive a JWT token. Exploitation can lead to unauthorized access to organizations, billing data, API keys, and payment integrations.