# CVE-2026-55377: Logto MFA bypass in Account Center step-up verification

Source: https://junglewise.ai/threats/cve-2026-55377-logto-mfa-bypass-in-account-center-step-up-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55377 · Severity: high · CVSS 8.1 · Published 2026-07-10

Logto is an open-source authentication platform used by developers to manage user logins and security for applications. A security flaw in the platform's Account Center allowed users to bypass multi-factor authentication (MFA) requirements when managing their security settings. Specifically, an attacker with basic account access could manipulate verification records to add or remove security keys and MFA factors without providing their password or existing MFA codes. This could lead to unauthorized account takeovers if a user's initial session token is compromised.

Technologies: [Logto](https://junglewise.ai/threats/technologies/logto). Vendors: [Logto](https://junglewise.ai/threats/vendors/logto).

## Quick answers

**Is CVE-2026-55377 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55377 being exploited in the wild.

**How severe is CVE-2026-55377?** High severity, with a CVSS score of 8.1, published 10 July 2026.

**Which products and versions are affected?** Logto < 1.41.0.

**Is there a fix for CVE-2026-55377?** A patch was published on 2026-06-30: Version 1.41.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55377 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55377?** Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability existed in Logto's Account Center step-up verification logic prior to version 1.41.0. The root cause was an overly permissive check that accepted any active verification record (where isVerified === true) belonging to the current user. An attacker possessing a valid Account API bearer token could create and verify a WebAuthn registration record for a new passkey. By sending this record ID in the 'logto-verification-id' header, the attacker could trick Account Center routes into treating the session as 'identityVerified=true'. This allowed the attacker to manage MFA factors and security settings without providing a password, identifier, or existing MFA factor. The fix restricts step-up verification specifically to user permission verification records.

## Affected products

- logto-io Logto < 1.41.0

## Timeline

- 2026-06-29: other: Fix pull request submitted
- 2026-06-30: patched: Version 1.41.0 released with fix
- 2026-07-10: disclosed: CVE-2026-55377 published

## References

- [https://github.com/logto-io/logto/commit/f56255a7edf3b22b0ec2fdb814814ce6b0123b74](https://github.com/logto-io/logto/commit/f56255a7edf3b22b0ec2fdb814814ce6b0123b74)
- [https://github.com/logto-io/logto/pull/9110](https://github.com/logto-io/logto/pull/9110)
- [https://github.com/logto-io/logto/releases/tag/v1.41.0](https://github.com/logto-io/logto/releases/tag/v1.41.0)
- [https://github.com/logto-io/logto/security/advisories/GHSA-q4h3-38gc-4p4j](https://github.com/logto-io/logto/security/advisories/GHSA-q4h3-38gc-4p4j)

## Related threats

- [Logto Account API authorization bypass for third-party tokens](https://junglewise.ai/threats/cve-2026-63203-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto SSRF in webhook and connector endpoints](https://junglewise.ai/threats/cve-2026-56739-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto server-side request forgery in OIDC connector creation](https://junglewise.ai/threats/cve-2026-82263-logto-server-side-request-forgery-in-oidc-connector-creation)
- [Logto server-side request forgery in webhook test endpoint](https://junglewise.ai/threats/cve-2026-82262-logto-server-side-request-forgery-in-webhook-test-endpoint)
- [Logto account takeover via improper identifier normalization](https://junglewise.ai/threats/cve-2026-15617-logto-account-takeover-via-improper-identifier-normalization)