Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-54714Logto: XSS via unescaped RelayState in SAML auto-submit form

Medium 6.1

In plain English

A medium-severity cross-site scripting in logto from logto-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0.

Affected products (as reported)

Vendor	Product	Versions
logto-io	logto	< 1.41.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f x_refsource_CONFIRM
https://github.com/logto-io/logto/pull/9008 x_refsource_MISC
https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e x_refsource_MISC
https://github.com/logto-io/logto/releases/tag/v1.41.0 x_refsource_MISC