Is CVE-2026-55377 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55377 being exploited in the wild.

How severe is CVE-2026-55377?

High severity, with a CVSS score of 8.1, published 10 July 2026.

Is there a fix for CVE-2026-55377?

A patch was published on 2026-06-30: Version 1.41.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55377 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55377?

Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55377: Logto MFA bypass in Account Center step-up verification

CVE-2026-55377 · Severity: high · CVSS 8.1 · Published 2026-07-10

Logto is an open-source authentication platform used by developers to manage user logins and security for applications. A security flaw in the platform's Account Center allowed users to bypass multi-factor authentication (MFA) requirements when managing their security settings. Specifically, an attacker with basic account access could manipulate verification records to add or remove security keys and MFA factors without providing their password or existing MFA codes. This could lead to unauthorized account takeovers if a user's initial session token is compromised.

Technologies: Logto. Vendors: Logto.

Quick answers

Is CVE-2026-55377 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55377 being exploited in the wild.
How severe is CVE-2026-55377?: High severity, with a CVSS score of 8.1, published 10 July 2026.
Which products and versions are affected?: Logto < 1.41.0.
Is there a fix for CVE-2026-55377?: A patch was published on 2026-06-30: Version 1.41.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55377 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55377?: Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability existed in Logto's Account Center step-up verification logic prior to version 1.41.0. The root cause was an overly permissive check that accepted any active verification record (where isVerified === true) belonging to the current user. An attacker possessing a valid Account API bearer token could create and verify a WebAuthn registration record for a new passkey. By sending this record ID in the 'logto-verification-id' header, the attacker could trick Account Center routes into treating the session as 'identityVerified=true'. This allowed the attacker to manage MFA factors and security settings without providing a password, identifier, or existing MFA factor. The fix restricts step-up verification specifically to user permission verification records.

Affected products

logto-io Logto < 1.41.0

Timeline

2026-06-29: other: Fix pull request submitted
2026-06-30: patched: Version 1.41.0 released with fix
2026-07-10: disclosed: CVE-2026-55377 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.