Is CVE-2026-55370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55370 being exploited in the wild.

How severe is CVE-2026-55370?

Medium severity, with a CVSS score of 6.4, published 10 July 2026.

Is there a fix for CVE-2026-55370?

A patch was published on 2026-06-30: Version 1.41.0 released containing the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55370 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55370?

Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55370: Logto TOTP authentication bypass via capture-replay

CVE-2026-55370 · Severity: medium · CVSS 6.4 · Published 2026-07-10

Logto, an open-source authentication platform for applications, was found to have a flaw in its multi-factor authentication (MFA) process. The system failed to properly invalidate one-time passwords (TOTP) after they were used, allowing a code to be reused multiple times within its short validity window. If an attacker manages to steal a user's primary password and intercept a live MFA code, they could potentially log in as that user even if MFA is enabled.

Technologies: Logto. Vendors: Logto.

Quick answers

Is CVE-2026-55370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55370 being exploited in the wild.
How severe is CVE-2026-55370?: Medium severity, with a CVSS score of 6.4, published 10 July 2026.
Which products and versions are affected?: Logto < 1.41.0.
Is there a fix for CVE-2026-55370?: A patch was published on 2026-06-30: Version 1.41.0 released containing the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55370 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55370?: Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Logto's TOTP verification mechanism was vulnerable to replay attacks because it utilized a stateless check without persisting or comparing the time-step counter. Specifically, the verifier used the 'otplib' library with a window setting of 1 but did not track whether a specific code had already been successfully validated. An attacker who has obtained a victim's primary credentials and can intercept a valid TOTP code (e.g., via man-in-the-middle or shoulder surfing) can replay that code to satisfy the MFA requirement as long as the code remains within the 30-60 second acceptance window. The fix, introduced in version 1.41.0, involves recording the last-used time-step counter and rejecting any subsequent attempts using the same or an older counter.

Affected products

logto-io Logto < 1.41.0

Timeline

2026-06-29: disclosed: Pull request submitted to fix the replay issue.
2026-06-30: patched: Version 1.41.0 released containing the fix.
2026-07-10: advisory: CVE-2026-55370 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.