CVE-2026-54714 Details
Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0.
A cross-site scripting vulnerability has been identified in Logto's SAML application handling, specifically in the @logto/core package, prior to version 1.41.0. The issue arises because the application reflects the SAML RelayState, SAMLResponse, and actionUrl into an auto-submit HTML form without proper escaping of HTML attributes. This flaw allows for the injection of scripts that can execute on the Logto tenant origin after a user logs in. The vulnerability can be exploited by sending a crafted RelayState through the SAML authentication API, injecting script that runs in the context of the user's session.
Users can update to Logto version 1.41.0 or later, where this vulnerability has been patched. The update is available on the Logto GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e | [email protected] | Source CodeVendor |
| https://github.com/logto-io/logto/pull/9008 | [email protected] | Source CodeVendor |
| https://github.com/logto-io/logto/releases/tag/v1.41.0 | [email protected] | Release NotesVendor |
| https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Logto | <= 1.40.1 (semver) |
CPE
Remediation
| |
| Logto Core | <= 1.40.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |