CVE-2026-55377: Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the logto-verification-id header and treated as identityVerified=true by Account Center routes, allowing MFA factor management without proving possession of an existing password, identifier, or MFA factor. This issue is fixed in version 1.41.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Logtoto a version that resolves this vulnerability.Fixed in 1.41.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55377?
The severity of CVE-2026-55377 is rated as high with a score of 8.1.
How do I fix CVE-2026-55377?
To fix CVE-2026-55377, update Logto to version 1.41.0 or later.
What component of Logto is affected by CVE-2026-55377?
CVE-2026-55377 affects the Account Center's MFA management step-up verification process.
What type of attack does CVE-2026-55377 enable?
CVE-2026-55377 enables a bypass of the MFA management step-up via WebAuthn registration verification.
What impact can CVE-2026-55377 have on users?
CVE-2026-55377 can allow an attacker to impersonate a user by bypassing MFA protections.