Executive brief
Logto, an open-source authentication platform for applications, was found to have a flaw in its multi-factor authentication (MFA) process. The system failed to properly invalidate one-time passwords (TOTP) after they were used, allowing a code to be reused multiple times within its short validity window. If an attacker manages to steal a user's primary password and intercept a live MFA code, they could potentially log in as that user even if MFA is enabled.
Technical details
Logto's TOTP verification mechanism was vulnerable to replay attacks because it utilized a stateless check without persisting or comparing the time-step counter. Specifically, the verifier used the 'otplib' library with a window setting of 1 but did not track whether a specific code had already been successfully validated. An attacker who has obtained a victim's primary credentials and can intercept a valid TOTP code (e.g., via man-in-the-middle or shoulder surfing) can replay that code to satisfy the MFA requirement as long as the code remains within the 30-60 second acceptance window. The fix, introduced in version 1.41.0, involves recording the last-used time-step counter and rejecting any subsequent attempts using the same or an older counter.
Affected products
- logto-io Logto < 1.41.0
Timeline
- 2026-06-29: disclosed: Pull request submitted to fix the replay issue.
- 2026-06-30: patched: Version 1.41.0 released containing the fix.
- 2026-07-10: advisory: CVE-2026-55370 published.