Logto fixes flaws enabling account takeover and MFA bypass

Logto published four security advisories on 9 November 2026 for its open‑source identity platform, with the most severe flaw rated CVSS 9.1. The Apple sign‑in account takeover (GHSA-gfg4-7mg4-wpm2) could allow an attacker with any Apple ID to take over a victim’s account; the advisory notes that Apple ships the user’s email in two places and the connector prioritised an unsigned field, enabling an attacker to replace it with an address of their choosing.

This affects every tenant that uses the Apple social connector and does not require the user to take any action. The other issues include an MFA bypass (GHSA-m7px-7mj4-gj53, CVSS 8.1) where an attacker with the victim’s password can complete sign‑in without the second factor by switching to a registration flow, and a SAML audience bypass (GHSA-c475-vw46-2r98, CVSS 7.4) in which a signed assertion for another app could log a user into Logto if the audience is not checked.

A separate tunnel denial of service (GHSA-cr4j-qhrf-249w, CVSS 7.5) arises from a Range header handling flaw in the @logto/tunnel proxy, where one unauthenticated GET against a 6‑byte file can crash the tunnel.

Logto recommends upgrading to Logto 1.46.0 to fix the Apple, MFA and SAML issues, and updating @logto/connector-apple to 1.6.11 and @logto/tunnel to 0.3.12 (both released on 5 November). Until patching, users should disable the Apple social connector; to mitigate the MFA bypass, set sign‑in mode to sign‑in only (disabling registration); and keep the tunnel bound to localhost during local UI testing.

Affected versions include Apple account takeover (Logto 1.14.0–1.45.0 and @logto/connector-apple 1.2.0–1.6.10), MFA bypass (Logto 1.45.0 and earlier), SAML bypass (Logto 1.12.0–1.45.0) and tunnel DoS (@logto/tunnel 0.3.11 and earlier). Review of Apple‑linked accounts created or linked before upgrading is advised.