CVE-2026-54714: Logto: XSS via unescaped RelayState in SAML auto-submit form
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@logto/coreto a version that resolves this vulnerability.Fixed in 1.41.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54714?
CVE-2026-54714 has a medium severity score of 6.1.
What type of vulnerability is CVE-2026-54714?
CVE-2026-54714 is an XSS vulnerability caused by unescaped RelayState in SAML auto-submit forms.
How can I mitigate CVE-2026-54714?
To mitigate CVE-2026-54714, upgrade to Logto version 1.41.0 or later where the vulnerability has been fixed.
What software is affected by CVE-2026-54714?
CVE-2026-54714 affects Logto @logto/core prior to version 1.41.0.
What impact does CVE-2026-54714 have?
Exploitation of CVE-2026-54714 can lead to cross-site scripting attacks, allowing an attacker to execute malicious scripts in the user's browser.