EUVD-2026-48305
Improper Authentication (CWE-287)
GHSA-26cp-25m8-5fgc
9.1
CVSS 3.1 · Vendor: cert
Share
Severity by source
Vendor (cert)
PRIMARY
9.1
CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (cert) · only source for this CVE.
CVSS VectorVendor: cert
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Lifecycle Timeline
4
Analysis Generated
Jul 27, 2026 - 17:22 vuln.today
CVSS changed
Jul 27, 2026 - 17:22 NVD
9.1 (CRITICAL)
CVE Published
Jul 23, 2026 - 16:17 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 23, 2026 - 16:17 cve.org
CRITICAL 9.1
DescriptionCVE.org
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
AnalysisAI
Account takeover in Logto due to unverified email-based SSO linking allows attackers to gain unauthorized access to victim accounts. Affected versions 1.11.0 through 1.37.1 allow an attacker to register with a permissive identity provider using a victim's email and link that identity to the victim's existing account without email verification, bypassing authentication. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).