A critical authentication vulnerability in Logto allows unauthenticated attackers to hijack user accounts via improper SSO account linking.

This flaw is classified as Improper Authentication (CWE-287). It occurs because the application fails to verify email addresses during the Single Sign-On account linking process, allowing an attacker to associate a victim's email address with an account they control at a permissive identity provider.

The ability for an attacker to gain unauthorized access to victim accounts poses a severe risk to data confidentiality and integrity. Given the 9.1 CVSS score, this vulnerability is critical, as it allows for full account takeover without requiring user interaction or authentication. Successful exploitation could lead to unauthorized access to sensitive user data, identity theft, and significant reputational damage to the organization.

Immediate Action: Administrators should review the vendor advisory for specific patch availability and apply the update as soon as it is released. If an update is not yet available, evaluate the feasibility of disabling SSO account linking features that rely on email verification.

Proactive Monitoring: Review authentication and account-linking logs for suspicious patterns, such as multiple account linking attempts from unknown or unauthorized identity providers.

Compensating Controls: Implement strict identity provider policies that require email domain verification and prevent the linking of unverified third-party identity accounts. Use a Web Application Firewall (WAF) to monitor and potentially block anomalous traffic directed at the identified verification endpoints.

Public Exploit Available: Unknown.

This vulnerability represents a severe threat to account security and must be treated with high priority. Organizations using Logto should actively monitor the vendor's security bulletins for the release of a permanent fix and prepare for immediate deployment once the patch is available.