Logto
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 10 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 10, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
Logto: Account API can disclose stored third-party provider tokens without the identities scope
Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
Logto Server-Side Request Forgery via webhook test endpoint
Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
IdP-initiated SAML sessions not reliably invalidated (replay)
Local MFA not enforced during SSO sign-in
Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
Logto: XSS via unescaped RelayState in SAML auto-submit form
Monitor Logto in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.