EUVD-2026-48301
GHSA-cv5x-2gg8-4hc7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Multi-factor authentication
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Remote attackers can bypass locally configured multi-factor authentication (MFA) in Logto when users authenticate via Single Sign-On (SSO). Affecting Logto versions 1.19.0 through 1.37.1, the flaw allows an attacker with valid SSO credentials to access user accounts without providing a second factor, leading to unauthorized data access and account manipulation. No public exploit is known, and EPSS indicates low exploitation probability (0.19%).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (cert) · only source for this CVE.
CVSS VectorVendor: cert
Lifecycle Timeline
3DescriptionCVE.org
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Executive ViewAI
A critical vulnerability in Logto identity platform (versions 1.19.0 through 1.37.1) allows attackers with valid SSO credentials to bypass multi-factor authentication, potentially enabling unauthorized access to user accounts and sensitive data. Leadership should prioritize this as it undermines MFA protections across all SSO-integrated applications, increasing risk of account takeover and data breach.
Within 24 hours: Disable SSO-based authentication or restrict to trusted identity providers only; monitor authentication logs for anomalous SSO logins without MFA. Within 7 days: Implement compensating controls such as conditional access policies requiring device compliance checks or IP whitelisting for SSO sessions; review and enforce session timeouts and re-authentication triggers. Within 30 days: Evaluate vendor updates or patches when available; consider temporarily disabling multi-factor authentication for SSO users if alternative protections are in place, or migrate affected Logto instances to a patched version when released.
No vendor-released patch identified at time of analysis. Compensating controls include: (1) disable SSO integration or restrict to known trusted IdPs, (2) enforce additional conditional access policies (e.g., device compliance, location-based), (3) increase monitoring for SSO logins lacking MFA validation, (4) implement session risk scoring and step-up authentication for sensitive actions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB