VU#492466: Logto Identity Platform has authentication and authorization failures in core protocol handling
Brief
Overview
The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, or submit identity assertions without proper cryptographic or validity checks.
Collectively, the issues create several paths for unauthorized access across both local and federated sign‑in flows.
Description
Developed by Silverhand Inc. , Logto is an identity and access management system for software as a service (SaaS) and AI applications. It provides multi‑tenant authentication, single sign-on (SSO), role-based access control (RBAC), support for openId connect (OIDC), open authorization (OAuth) 2. 1, and Security Assertion Markup Language (SAML) authentication.