logto
v1.46.0🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- MPL-2.0Weak copyleft · OSI-approved
- Security
- 24 advisories1 critical, 15 high, 8 medium
- Supported versions
- No scheduleendoflife.date does not track this project
14.9k stars · 1.2k forks · 131 open issues · last release 10 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 24 most recent advisories published by the maintainers: 1 critical, 15 high, 8 medium. Check the patched version against the one you run.
- mediumGHSA-2pq4-jqvf-f7qjNov 9, 2026Concurrent requests can redeem one authorization code or pushed request_uri more than once
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- mediumGHSA-c5hj-jm58-pxh9Nov 9, 2026Third-party OAuth app can steal a user's live upstream social/SSO provider access tokens via the Account API (missing assertFirstPartyClient on the third-party-token endpoints)
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- mediumGHSA-25xg-rqq2-87gqNov 9, 2026SAML application authentication endpoint accepts XML that is not well-formed
- Affected
- >= 1.23.1, <= 1.45.0
- Patched in
- 1.46.0
- mediumGHSA-x8h5-94m9-7jw4Nov 9, 2026Email/SMS connector credentials returned in the API response body and stored in audit logs on an outbound network error
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- mediumGHSA-3xj6-982x-2r3gNov 9, 2026One-time token can be verified twice concurrently due to missing status predicate in UPDATE query
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- highGHSA-c475-vw46-2r98Nov 9, 2026logto vulnerable to SAML authentication bypass via unchecked assertion audience
- Affected
- >= 1.12.0, <= 1.45.0
- Patched in
- 1.46.0
- highGHSA-cr4j-qhrf-249wNov 9, 2026Unauthenticated one-request denial of service in `@logto/tunnel`: the `Range` end is never clamped to the file size, so `fileHandle.read()` gets a length above `INT32_MAX` and Node aborts
- Affected
- <= 0.3.11
- Patched in
- 0.3.12
- highGHSA-m7px-7mj4-gj53Nov 9, 2026MFA bypass: switching interaction event SignIn→Register after identification skips second-factor verification
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- highGHSA-f78f-ghjf-hrx2Nov 9, 2026MFA bypass: a verified enterprise-SSO or sign-in-passkey verification record not bound to the identified user skips the mandatory second factor
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- criticalGHSA-gfg4-7mg4-wpm2Nov 9, 2026Apple connector trusts the unsigned user.email form field, allowing account takeover
- Affected
- >= 1.2.0, <= 1.6.10; >= 1.14.0, <= 1.45.0
- Patched in
- 1.6.11; 1.46.0
- highCVE-2026-55216Nov 5, 2026Account takeover via email_verified bypass in social account linking (Azure AD, OAuth2 connectors)
- Affected
- <= 1.45.0
- Patched in
- 1.46.0
- highCVE-2026-63203Sep 1, 2026Account API can disclose stored third-party provider tokens without the identities scope
- Affected
- >= 1.31.0, <= 1.41.0
- Patched in
- 1.42.0
- highCVE-2026-56739Sep 1, 2026SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint (CWE-918)
- Affected
- <= 1.42.0
- Patched in
- 1.43.0
- highGHSA-5wr4-942j-h43mSep 1, 2026JWT Customizer node:vm execution has no effective timeout, allowing full-process or tenant-wide DoS
- Affected
- <= 1.42.0
- Patched in
- 1.43.0
- highGHSA-p88q-p28c-j9jfSep 1, 2026OAuth/SSO authorization-code exfiltration and cross-session account takeover via attacker-controlled native_callback parameter in social/SSO landing flow
- Affected
- <= 1.42.0
- Patched in
- 1.43.0
- highGHSA-crc8-q4hm-4564Sep 1, 2026Third-party application with only the openid scope can set an initial password on a passwordless, email-less, phone-less account, enabling account takeover
- Affected
- <= 1.42.0
- Patched in
- 1.43.0
- highGHSA-vrv3-3j98-vfppSep 1, 2026Token exchange accepts an ID token as an access-token subject and ignores the subject token's issuing client, widening a consented credential into the user's full first-party API authorization
- Affected
- >= 1.38.0, <= 1.42.0
- Patched in
- 1.43.0
- mediumCVE-2026-63187Aug 14, 2026OS command injection vulnerability exists in the Commitlint workflow
- Affected
- >=v1.40.1
- Patched in
- v1.41.0
- highCVE-2026-63188Jul 2, 2026logto-tunnel serves files outside --experience-path via path traversal
- Affected
- <=0.3.8
- Patched in
- 0.3.9
- highCVE-2026-55377Jul 1, 2026Account Center MFA management step-up bypass via WebAuthn registration verification
- Affected
- <= 1.40.1
- Patched in
- 1.41.0
- mediumCVE-2026-55370Jul 1, 2026TOTP code can be replayed within the RFC 6238 acceptance window
- Affected
- <= 1.40.1
- Patched in
- 1.41.0
- highCVE-2026-62317Jul 1, 2026ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
- Affected
- <= 1.40.1
- Patched in
- 1.41.0
- highCVE-2026-55789Jul 1, 2026SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers
- Affected
- <= 1.40.1
- Patched in
- 1.41.0
- mediumCVE-2026-54714Jul 1, 2026XSS via unescaped RelayState in SAML auto-submit form
- Affected
- <= 1.40.1
- Patched in
- 1.41.0