Logto flaws enable account takeover and MFA bypass

The content discusses six critical vulnerabilities identified in the Logto identity platform by CERT/CC, particularly affecting authentication processes such as SSO and MFA. Key points include:

• **CVE Overview:** Two critical CVEs are specifically highlighted, with a total of six vulnerabilities reported on July 23, 2026. No patches are available, and the vendor, Silverhand Inc., has not been reachable for coordination.
• **Vulnerability Details:** The vulnerabilities allow attackers to hijack accounts via unverified email linking and bypass locally configured MFA.
• **Exploitation Status:** Although these vulnerabilities exist, there have been no confirmed active exploits in the wild.
• **Mitigation Recommendations:** Recommendations include enforcing MFA at the identity provider level, avoiding shared email addresses for local accounts, and monitoring authentication logs for suspicious activities.
• **Affected Versions:** Currently, no specific affected or fixed versions are noted; it's recommended to treat all existing deployments as potentially vulnerable until further guidance is issued.

Overall, the response emphasizes the importance of immediate attention to these flaws due to their potential impact on secure authentication.