Product by Logto-io

    Logto

    11 known vulnerabilities in Logto (Logto-io), 0 of them actively exploited (CISA KEV).

    Key figures

    11

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Logto (Logto-io)
    HighCVE-2026-62317

    Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)

    		7.5
    HighCVE-2026-63188

    logto-tunnel serves files outside --experience-path via path traversal

    		—
    HighCVE-2026-82263

    Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

    		6.8
    HighCVE-2026-82262

    Logto Server-Side Request Forgery via webhook test endpoint

    		6.8
    HighCVE-2026-56739

    Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint

    		—
    HighCVE-2026-63203

    Logto: Account API can disclose stored third-party provider tokens without the identities scope

    		7.6
    HighCVE-2026-55377

    Logto: Account Center MFA management step-up bypass via WebAuthn registration verification

    		8.1
    HighCVE-2026-55789

    Logto: XML Injection (aka Blind XPath Injection)

    		8.5
    MediumCVE-2026-63187

    Logto: OS command injection vulnerability exists in the Commitlint workflow

    		6.3
    MediumCVE-2026-55370

    Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)

    		6.4
    MediumCVE-2026-54714

    Logto: XSS via unescaped RelayState in SAML auto-submit form

    		6.1

    All products by Logto-io