WebAuthn Registration Vulnerability in Logto Auth Infrastructure

CVE-2026-55377

What is CVE-2026-55377?

The Logto Auth Infrastructure, an open-source authentication solution for SaaS and AI applications, contains a vulnerability that permits unauthorized management of multi-factor authentication (MFA) factors before version 1.41.0. It allows an attacker to bypass the legitimate verification process by utilizing an existing Account API bearer token. This issue enables the creation and verification of a WebAuthn registration record to bind a new passkey without requiring the possession of the user's password or other MFA factors, posing a significant security risk. The vulnerability has been patched in version 1.41.0.

References