Executive brief
Logto, an authentication platform for software applications, contained a security flaw in how it handled SAML login requests. An attacker could craft a malicious link that, if clicked by a user during the login process, could execute unauthorized scripts in the user's browser. This could allow an attacker to perform actions on behalf of the user or interfere with the login session.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in @logto/core prior to version 1.41.0. The vulnerable component, `packages/core/src/saml-application/SamlApplication/utils.ts`, fails to perform HTML-attribute escaping when reflecting the `RelayState`, `SAMLResponse`, and `actionUrl` parameters into an auto-submitting HTML form. An attacker can exploit this by crafting a malicious SAML authentication request (via GET or POST to `/api/saml/:id/authn`) containing a payload in the `RelayState`. When a user completes the login flow, the injected script executes within the context of the Logto tenant origin. The fix, introduced in version 1.41.0, implements proper HTML escaping for these attributes and restricts the `actionUrl` to authorized web schemes.
Affected products
- logto-io logto < 1.41.0
Timeline
- 2026-06-12: patched: Fix committed to repository
- 2026-06-30: advisory: Release v1.41.0 published
- 2026-07-10: disclosed: CVE-2026-54714 published