# CVE-2026-63203: Logto Account API authorization bypass for third-party tokens

Source: https://junglewise.ai/threats/cve-2026-63203-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-63203 · Severity: high · CVSS 7.6 · Published 2026-09-24

Logto is an open-source authentication platform used by SaaS and AI applications. Versions 1.31.0 through 1.42.0 have a flaw in the Account API that allows an application with limited access to retrieve stored social login or enterprise SSO provider tokens for other purposes, potentially giving that application unauthorized access to upstream services that those tokens grant access to.

Technologies: [Logto](https://junglewise.ai/threats/technologies/logto). Vendors: [Logto](https://junglewise.ai/threats/vendors/logto).

## Quick answers

**Is CVE-2026-63203 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63203 being exploited in the wild.

**How severe is CVE-2026-63203?** High severity, with a CVSS score of 7.6, published 24 September 2026.

**Which products and versions are affected?** Logto 1.31.0 to 1.41.x.

**Is there a fix for CVE-2026-63203?** A patch was published on 2026-07-02: Fix merged requiring identities scope for third-party token endpoints Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63203 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63203?** Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Account API third-party token endpoints (GET /api/my-account/identities/{target}/access-token and GET /api/my-account/sso-identities/{connectorId}/access-token) in packages/core/src/routes/account/third-party-tokens.ts did not enforce the required 'identities' user scope, despite other identity endpoints enforcing it. An authenticated user with only the openid scope can retrieve federated provider access tokens, bypassing the intended consent boundary. Exploitation requires federated token-set storage to be enabled and a supported connector to have been used; the obtained token can then be used against upstream APIs within that token's granted scopes.

## Affected products

- Logto Logto 1.31.0 to 1.41.x

## Timeline

- 2026-07-02: patched: Fix merged requiring identities scope for third-party token endpoints
- 2026-09-24: disclosed

## References

- [https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c224](https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c224)
- [https://github.com/logto-io/logto/pull/9116](https://github.com/logto-io/logto/pull/9116)

## Related threats

- [Logto SSRF in webhook and connector endpoints](https://junglewise.ai/threats/cve-2026-56739-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto server-side request forgery in OIDC connector creation](https://junglewise.ai/threats/cve-2026-82263-logto-server-side-request-forgery-in-oidc-connector-creation)
- [Logto server-side request forgery in webhook test endpoint](https://junglewise.ai/threats/cve-2026-82262-logto-server-side-request-forgery-in-webhook-test-endpoint)
- [Logto account takeover via improper identifier normalization](https://junglewise.ai/threats/cve-2026-15617-logto-account-takeover-via-improper-identifier-normalization)
- [Logto MFA bypass during SSO authentication](https://junglewise.ai/threats/cve-2026-15616-logto-mfa-bypass-during-sso-authentication)