CVE-2026-55789
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders unescaped. An authenticated low-privilege user could place XML markup in a profile attribute so Logto signed a forged SAML attribute, such as an arbitrary role, allowing privilege escalation at relying Service Providers that authorize on SAML attributes. This issue is fixed in version 1.41.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
- EPSS probability
- 0.40%
- CWE
- CWE-91, CWE-1395
- Published
- 2026-07-10
- Last modified
- 2026-07-13
Affected products
- logto-io logto
Weakness type
Related vulnerabilities
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83616 — xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-83608 — xmldom: DocType `name` Injection Bypasses requireWellFormed
- CVE-2026-83607 — xmldom: Element name injection via createElement() bypasses requireWellFormed
- CVE-2026-83605 — xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
- CVE-2026-48590 — Element and Attribute Names Injected Verbatim into XML Output in xml_builder