Logto SSO flaws enable account takeover, MFA bypass
Six unpatched vulnerabilities in Logto's OIDC/SAML/SSO identity pipeline let attackers hijack accounts, bypass MFA, and replay federated sign-ins.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed six vulnerabilities in Logto, an identity and access management platform used for SaaS and AI applications, affecting its OIDC, OAuth 2.1, and SAML authentication flows. The flaws stem from weak identity verification logic: Logto links SSO identities to local accounts based solely on email address without confirming the IdP's email_verified flag, skips nonce validation in id_tokens that omit the claim, fails to atomically handle IdP-initiated SAML session deletion (enabling replay), and relies on the samlify library's flawed handling of missing Conditions elements to skip assertion time-window checks. Additionally, MFA can be bypassed entirely for users who authenticate via SSO, and unnormalized string comparisons on identity attributes can cause sessions to bind to unintended accounts.
Combined, these issues undermine core guarantees of federated authentication — account-ownership verification, replay protection, assertion validity windows, and MFA enforcement — across both local and SSO-based sign-in flows. An attacker controlling or abusing a permissive upstream IdP could take over victim accounts, replay stale SAML assertions to authorize multiple sessions, or bypass locally configured MFA. Silverhand Inc., the vendor, could not be reached for coordinated disclosure, so no patch is currently available; CERT/CC has published defensive mitigations including avoiding shared email-based local/SSO accounts, disabling the SAML connector, enforcing MFA at the IdP layer, and shortening session lifetimes.
This is a vulnerability disclosure with proof-of-concept-level technical detail from academic researchers at the University of Toronto, not a report of active exploitation. Organizations using Logto for identity and access management should treat this as an urgent hardening task given the lack of vendor patch and the breadth of authentication bypass paths across multiple protocols.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/492466
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs