EUVD-2026-43009Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS, no attacker privileges needed, victim must complete login (UI:R), scope changes to Logto origin; no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0.
AnalysisAI
Reflected XSS in Logto's SAML application flow allows unauthenticated remote attackers to inject and execute arbitrary JavaScript on the Logto tenant origin by supplying a crafted RelayState parameter. Versions prior to 1.41.0 of @logto/core reflect the SAML RelayState, SAMLResponse, and actionUrl directly into an auto-submit HTML form without HTML-attribute escaping, meaning a victim who follows a crafted SAML authentication link and completes the login sequence will execute attacker-controlled script within the identity provider's origin context. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though a GitHub security advisory and fix commit are publicly available.
Technical ContextAI
Logto is an open-source, self-hosted authentication and authorization infrastructure implementing OIDC and SAML protocols, targeting SaaS and AI application developers. The flaw resides in packages/core/src/saml-application/SamlApplication/utils.ts, where the SAML RelayState - an opaque passthrough string defined by the SAML protocol to allow service providers to maintain state across the authentication redirect loop - along with SAMLResponse and actionUrl, are interpolated into an auto-submit HTML form template without HTML-attribute escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: unsanitized user-supplied data reaches an HTML rendering context, enabling injection of event handlers or script tags. Because the form is served from the Logto tenant origin, successful injection yields same-origin script execution against the identity provider itself, which may hold session cookies, OIDC tokens, and administrative interfaces.
RemediationAI
Upgrade Logto to version 1.41.0 or later, which contains the HTML-attribute escaping fix applied in commit 209fa0a5cbe8522f9cf31873239dc6424099bb5e (PR #9008). The official release is available at https://github.com/logto-io/logto/releases/tag/v1.41.0 and the security advisory is at https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f. If immediate upgrade is not feasible, a compensating control is to disable SAML application functionality entirely within the Logto admin console, eliminating the vulnerable code path; this trade-off is that any SAML-federated service providers relying on Logto as an IdP will lose authentication capability. Network-layer controls (blocking external access to /api/saml/:id/authn) can reduce attack surface if Logto is only used for internal SAML federation, but will not protect against threats originating from the internal network. Content Security Policy headers, if configurable via a reverse proxy in front of Logto, can limit the impact of injected scripts but are not a substitute for the code fix.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today