CVE-2026-63203: Logto: Account API can disclose stored third-party provider tokens without the identities scope
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Logtoto a version that resolves this vulnerability.Fixed in 1.42.0
Event History
Frequently Asked Questions
Who is exposed to token disclosure?
Deployments are exposed only when federated token-set storage is enabled and an affected user has authenticated through a supported social or enterprise SSO connector. The vulnerable versions are 1.31.0 through versions before 1.42.0.
What does an attacker need to exploit this issue?
The attacker needs a same-user access token carrying only the openid scope and user interaction is required. They can then request the affected Account API access-token endpoints without the identities scope.
What is the impact of a disclosed provider token?
A low-trust application can use the retrieved third-party provider token against upstream APIs, limited by the scopes granted to that provider token. The issue bypasses the intended Account API consent boundary for identity information.
What should be done to remediate the issue?
Upgrade Logto to version 1.42.0, which fixes the missing identities-scope enforcement. If immediate patching is not possible, the provided information does not specify a workaround.