CyberRota Analysis
AI-GeneratedLogto is vulnerable to an exploit that allows attackers to link their accounts to victims' identities via email-based Single Sign-On (SSO) without proper verification. This critical vulnerability can lead to unauthorized access to user accounts, posing significant risks to user data and privacy. Organizations utilizing Logto for authentication should prioritize immediate remediation to protect their users from potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.