Veille CVE
CVE-2026-63203
7.6 ÉlevéeDescription
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.6 Élevée | security-advisories@github.com | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N |
Faiblesses (CWE)
Références
- https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c224
- https://github.com/logto-io/logto/pull/9116
- https://github.com/logto-io/logto/releases/tag/v1.42.0
- https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf
- https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf