logto-io vulnerabilities
11 published CVEs name logto-io among the affected products.
- 11Published CVEs11 of them scored
- 11Last 12 monthspublished in the last year
- 0Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-56739
Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
logto-io · logto
High8.5 - CVE-2026-63203
Logto: Account API can disclose stored third-party provider tokens without the identities scope
logto-io · logto
High7.6 - CVE-2026-82263
Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
logto-io · logto
High8.2 - CVE-2026-82262
Logto Server-Side Request Forgery via webhook test endpoint
logto-io · logto
High8.2 - CVE-2026-63187
Logto: OS command injection vulnerability exists in the Commitlint workflow
logto-io · logto
Medium6.3 - CVE-2026-63188
logto-tunnel serves files outside --experience-path via path traversal
logto-io · logto
High8.7 - CVE-2026-62317
Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
logto-io · logto
High7.5 - CVE-2026-55377
Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
logto-io · logto
High8.1 - CVE-2026-55370
Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
logto-io · logto
Medium6.4 - CVE-2026-55789
Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers
logto-io · logto
High8.5