CyberRota Analysis
AI-GeneratedLogto versions prior to 1.41.0 are vulnerable due to a flaw in the email subaddressing blocklist, which allows attackers to exploit the email input to create a regex that can cause event-loop stalls. This vulnerability can lead to denial of service, affecting authentication processes, token issuance, and access to the administrative console. Organizations using Logto for SaaS and AI applications should prioritize updating to version 1.41.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.