Logto Vulnerabilities Enable Account Takeover, MFA Bypass and SAML Login Bypass
Do Son 
TL;DR
Logto published four security advisories on November 9, 2026, for its open-source identity platform. The worst of these Logto vulnerabilities is rated CVSS 9.1. It lets an attacker with any Apple ID take over a victim’s account. Other flaws bypass multi-factor authentication, skip SAML audience checks and crash the developer tunnel.
Logto 1.45.0 and earlier contain an Apple sign-in account takeover, an MFA bypass and a SAML authentication bypass. Separately, @logto/tunnel 0.3.11 can be crashed with one unauthenticated request. Upgrade to Logto 1.46.0, @logto/connector-apple 1.6.11 and @logto/tunnel 0.3.12.
Why It Matters
Logto handles sign-in, SSO and MFA for the apps that rely on it. So a flaw in its login flow can expose every account behind it. For the Apple bug, the advisory warns that “the victim does not have to do anything.”
The advisories include detailed root-cause analysis and code references. However, no exploitation in the wild has been reported for any of the four flaws. None has a CVE ID yet.
How the Attacks Work
Apple connector account takeover (GHSA-gfg4-7mg4-wpm2, CVSS 9.1)
Apple sends the user’s email in two places: a signed ID token and an unsigned form field. The connector preferred the unsigned field. As the advisory puts it, “the person signing in can replace it with any address.” Consequently, an attacker could link their Apple ID to a victim’s existing account. They could also pre-register an account under the victim’s email before the victim signs up. “Every tenant that enables the Apple social connector is affected.”
MFA bypass (GHSA-m7px-7mj4-gj53, CVSS 8.1)
Logto only checked MFA for sign-in events. An attacker who knew a victim’s password could identify as that user, then switch the interaction to registration. Because Logto kept the identified user, the flow could “finish without the second factor.” The advisory calls it a “complete bypass of multi-factor authentication for any MFA-enrolled account whose password is known/compromised.” It works even when MFA is mandatory. A related gap, GHSA-f78f-ghjf-hrx2, is fixed in the same release.
SAML audience bypass (GHSA-c475-vw46-2r98, CVSS 7.4)
Logto’s SAML connector checked the signature but never read the assertion’s audience. Therefore, an assertion the identity provider signed for a different app could log a user into Logto. The researcher found that disabling Logto at the identity provider did not stop this path. “An operator who removes Logto from a user at the identity provider has not removed it.”
Tunnel denial of service (GHSA-cr4j-qhrf-249w, CVSS 7.5)
The @logto/tunnel static file proxy trusted the end value of an HTTP Range header. A huge value forced an oversized read that Node.js cannot catch. As a result, “one unauthenticated GET against a 6-byte file kills the tunnel.”
Affected Versions
- Apple account takeover: Logto 1.14.0 through 1.45.0, and @logto/connector-apple 1.2.0 through 1.6.10
- MFA bypass: Logto 1.45.0 and earlier
- SAML bypass: Logto 1.12.0 through 1.45.0
- Tunnel DoS: @logto/tunnel 0.3.11 and earlier
Patch and Mitigation
- Upgrade to Logto 1.46.0, which fixes the Apple, MFA and SAML issues.
- Update @logto/connector-apple to 1.6.11 and @logto/tunnel to 0.3.12. Both reached npm on November 5.
- Until then, disable the Apple social connector.
- To block the MFA bypass, set the sign-in mode to sign-in only, which disables registration.
- Keep the tunnel bound to localhost during local UI testing.
Review any Apple-linked accounts created or linked before the upgrade.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
