Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-55377Logto: Account Center MFA management step-up bypass via WebAuthn registration verification

High 8.1

In plain English

A high-severity improper authentication in logto from logto-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 65.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the logto-verification-id header and treated as identityVerified=true by Account Center routes, allowing MFA factor management without proving possession of an existing password, identifier, or MFA factor. This issue is fixed in version 1.41.0.

Affected products (as reported)

Vendor	Product	Versions
logto-io	logto	< 1.41.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/logto-io/logto/security/advisories/GHSA-q4h3-38gc-4p4j x_refsource_CONFIRM
https://github.com/logto-io/logto/pull/9110 x_refsource_MISC
https://github.com/logto-io/logto/commit/f56255a7edf3b22b0ec2fdb814814ce6b0123b74 x_refsource_MISC
https://github.com/logto-io/logto/releases/tag/v1.41.0 x_refsource_MISC