Authentication Bypass Vulnerability in Lago by GetLago

CVE-2026-119420

What is CVE-2026-119420?

Lago, up to version 1.55.0, suffers from an authentication bypass vulnerability due to inadequate password verification in the acceptInvite mutation. This flaw enables malicious actors to invite victims using their email addresses, allowing them to accept invitations using arbitrary passwords. Successfully doing so grants attackers a JSON Web Token (JWT), which can be used to gain unauthorized access to sensitive organizational data, including billing details, API keys, and payment integrations. Organizations using Lago should apply the necessary patches and review security configurations to mitigate this risk.

References