Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119420Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

High 8.8

In plain English

A high-severity authentication bypass in lago from getlago. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

Affected products (as reported)

Vendor	Product	Versions
getlago	lago	0 – through 1.55.0

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305 patch
https://github.com/getlago/lago-api/pull/6146 issue-tracking, patch
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98 technical-description
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16 technical-description
https://abraxaslabs.tech/research/lago-invite-ato third-party-advisory
https://github.com/getlago/lago-api product
VulnCheck Advisory: Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation third-party-advisory