All vulnerabilities
CVE-2026-63203GHSA-6g9q-qrx7-3jxf

Logto: Account API can disclose stored third-party provider tokens without the identities scope

logto-io logto
Open in ThreatlineRecord JSON
CVSS
7.6High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 24 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.42.0Fixed versionGitHub
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 1.42.0logto-io/logto, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.

Text from CVE List

Affected versions 2

  • logtoaffected: >= 1.31.0, < 1.42.0CVE List
  • logto-io/logto, other>= 1.31.0, <= 1.41.0GitHub

References 4