Executive brief
Logto is an open-source authentication platform used by developers to manage user logins and security for applications. A security flaw in the platform's Account Center allowed users to bypass multi-factor authentication (MFA) requirements when managing their security settings. Specifically, an attacker with basic account access could manipulate verification records to add or remove security keys and MFA factors without providing their password or existing MFA codes. This could lead to unauthorized account takeovers if a user's initial session token is compromised.
Technical details
An authentication bypass vulnerability existed in Logto's Account Center step-up verification logic prior to version 1.41.0. The root cause was an overly permissive check that accepted any active verification record (where isVerified === true) belonging to the current user. An attacker possessing a valid Account API bearer token could create and verify a WebAuthn registration record for a new passkey. By sending this record ID in the 'logto-verification-id' header, the attacker could trick Account Center routes into treating the session as 'identityVerified=true'. This allowed the attacker to manage MFA factors and security settings without providing a password, identifier, or existing MFA factor. The fix restricts step-up verification specifically to user permission verification records.
Affected products
- logto-io Logto < 1.41.0
Timeline
- 2026-06-29: other: Fix pull request submitted
- 2026-06-30: patched: Version 1.41.0 released with fix
- 2026-07-10: disclosed: CVE-2026-55377 published