EUVD-2026-62757Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a RegExp from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple @ signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public POST /api/experience/verification/verification-code endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Logto gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.
Executive ViewAI
Logto authentication platform versions before 1.41.0 contain a critical vulnerability allowing unauthenticated attackers to disable all authentication services organization-wide, blocking employee and customer logins. A threat actor can trigger a complete authentication outage with a single crafted email to a public API endpoint, requiring no special credentials or access. Organizations running affected versions face immediate risk of business interruption and operational downtime.
Within 24 hours, identify all Logto deployments in production and document current versions; confirm whether the public /api/experience/verification/verification-code endpoint is exposed to untrusted networks. Within 7 days, upgrade all affected Logto installations to version 1.41.0 or later, prioritizing systems handling critical authentication flows in production environments. Within 30 days, review authentication service logs for exploitation attempts, validate authentication availability and performance post-upgrade, and assess whether network segmentation or access restrictions should be applied to verification endpoints.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the t
Server-side request forgery in Logto prior to 1.43.0 allows an authenticated tenant administrator to point outbound conn
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to r
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct
Stored social and enterprise SSO provider access tokens can be retrieved from Logto's Account API by a low-trust applica
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell co
Exploit-DB