EUVD-2026-62757Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.
AnalysisAI
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a RegExp from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple @ signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public POST /api/experience/verification/verification-code endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Recommended ActionAI
Within 24 hours, identify all Logto deployments in production and document current versions; confirm whether the public /api/experience/verification/verification-code endpoint is exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the t
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell co
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today