Logto 1.46.0 fixes Apple sign-in account takeover, MFA bypass, SAML audience bypass and tunnel DoS
Logto published four security advisories on November 9, 2026 for its open-source identity platform. The most serious, an Apple social-connector flaw, carries a CVSS 9.1 score in the advisory as the article reports it. The Apple path needs the Apple connector to be enabled on the tenant, but once it is, an attacker holding any Apple ID can take over a victim's account without the victim doing anything. The other three issues are an MFA bypass for accounts whose password is already known (CVSS 8.1), a SAML assertion-audience bypass (CVSS 7.4) and an unauthenticated denial of service in the @logto/tunnel developer proxy (CVSS 7.5). The article reports no exploitation in the wild and no CVE ID yet. The fix is Logto 1.46.0, with @logto/connector-apple 1.6.11 and @logto/tunnel 0.3.12. Criticity is high rather than critical: the Apple and tunnel flaws are reachable without authentication, but the Apple case depends on a non-default connector, and no exploitation has been observed.
Entenda a falha
A vulnerabilidade
Logto, an open-source identity platform, got four advisories on November 9, 2026, none with a CVE yet. The worst (GHSA-gfg4-7mg4-wpm2, CVSS 9.1) is in the Apple social connector: if the tenant has it enabled, an attacker with any Apple ID can take over a victim's account or pre-register under the victim's email, with no action from the victim (Logto 1.14.0-1.45.0, @logto/connector-apple 1.2.0-1.6.10). GHSA-m7px-7mj4-gj53 (CVSS 8.1) is an MFA bypass for an account whose password is known (Logto 1.45.0 and earlier), and GHSA-f78f-ghjf-hrx2 is a related gap. GHSA-cr4j-qhrf-249w (CVSS 7.5) lets one unauthenticated request crash @logto/tunnel 0.3.11 and earlier. GHSA-c475-vw46-2r98 (CVSS 7.4) is a SAML audience bypass (Logto 1.12.0-1.45.0). Fixes: Logto 1.46.0, @logto/connector-apple 1.6.11, @logto/tunnel 0.3.12.
Como funciona
In the Apple flow, Apple returns the user's email in two places: a signed ID token and an unsigned form field. The connector took the email from the unsigned field, so whoever is signing in can change it, and Logto then matches or creates the account for that address. In the MFA case, an attacker with the password identifies as the victim and then switches the interaction from sign-in to registration; Logto keeps the identified user and completes the flow without asking for the second factor. In SAML, Logto checks the assertion signature but never looks at its audience. In the tunnel, the static file proxy uses the Range header's end value to decide how much to read.
Por que é vulnerável
Each flaw is a missing or misplaced check. The Apple connector trusted unsigned, user-controllable data over the signed token. MFA was enforced only on sign-in events, so another interaction type reached the same identified state without the check. The SAML connector validated the signature but skipped the audience restriction, so an assertion meant for another app was accepted. The tunnel trusted the Range end value without bounding it, and an oversized read raises an error Node.js cannot catch. The articles do not describe the fix in code terms or why the issues went unnoticed.
Onde está
The articles name no files or functions; they point to advisories GHSA-gfg4-7mg4-wpm2 (Apple connector), GHSA-m7px-7mj4-gj53 and GHSA-f78f-ghjf-hrx2 (MFA), GHSA-c475-vw46-2r98 (SAML connector) and GHSA-cr4j-qhrf-249w (@logto/tunnel static file proxy), which reportedly include code references.
Como foi descoberta
The articles do not say who found most of these flaws or how. They mention a researcher for the SAML finding, who observed that removing Logto from a user at the identity provider does not close that path. Logto published the four advisories on November 9, 2026, with detailed root-cause analysis, and the fixed @logto/connector-apple and @logto/tunnel packages reached npm on November 5. No exploitation in the wild has been reported and no CVE IDs have been assigned.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 22:16.
Detalhes técnicos
- Apple connector (GHSA-gfg4-7mg4-wpm2, CVSS 9.1): the connector read the user's email from an unsigned form field in preference to the signed ID token, so the person signing in can substitute any address (securityonline.info). An attacker can link their Apple ID to a victim's existing account or pre-register an account under the victim's address before the victim signs up. Affected: Logto 1.14.0 through 1.45.0 and @logto/connector-apple 1.2.0 through 1.6.10.
- MFA bypass (GHSA-m7px-7mj4-gj53, CVSS 8.1): MFA was enforced only on sign-in events. An attacker with a victim's password identifies as that user, then switches the interaction to registration, and the identified user is kept, so the flow completes without the second factor (securityonline.info). It applies even where MFA is mandatory. A related gap, GHSA-f78f-ghjf-hrx2, is fixed in the same release. Affected: Logto 1.45.0 and earlier.
- SAML audience bypass (GHSA-c475-vw46-2r98, CVSS 7.4): the SAML connector verified the signature but ignored the assertion's audience, so an assertion issued for another application can sign a user into Logto. Per the researcher, removing Logto from a user at the identity provider does not close this path (securityonline.info). Affected: Logto 1.12.0 through 1.45.0.
- Tunnel denial of service (GHSA-cr4j-qhrf-249w, CVSS 7.5): the static file proxy in @logto/tunnel trusted the end value of an HTTP Range header, and a very large value forces a read that Node.js cannot catch, so a single unauthenticated GET against a small file stops the tunnel. Affected: @logto/tunnel 0.3.11 and earlier.
The GitHub advisory pages, the Logto releases page and the fix pull requests could not be opened in this analysis, so the version ranges and CVSS values above rest on the article and on the release notes quoted below.
Remediação
- Upgrade Logto to 1.46.0, which the article says fixes the Apple, MFA and SAML issues. Its release notes, as quoted in a dependency-update pull request, describe security fixes for MFA, social and enterprise sign-in, the Account API and Logto Tunnel, and state that one of them needs admin action (github.com/Cloady/templates). Read that note before upgrading. The same notes list minimum Node.js versions of 22.23.4, 24.22.1 and 26.12.1 (github.com/Cloady/templates).
- Update @logto/connector-apple to 1.6.11 and @logto/tunnel to 0.3.12. The article says both reached npm on November 5.
- Until the upgrade, disable the Apple social connector. Set the sign-in mode to sign-in only to block the MFA bypass path, since that disables registration. Keep the tunnel bound to localhost during local UI testing.
- Review Apple-linked accounts created or linked before the upgrade. The article gives no interim mitigation for the SAML audience bypass, so the only protection there is the upgrade.
Linha do tempo
-
Logto 1.46.0 fixes Apple sign-in account takeover, MFA bypass, SAML audience bypass and tunnel DoS
ler a análise desta fonte ocultar
Logto published four security advisories on November 9, 2026 for its open-source identity platform. The most serious, an Apple social-connector flaw, carries a CVSS 9.1 score in the advisory as the article reports it. The Apple path needs the Apple connector to be enabled on the tenant, but once it is, an attacker holding any Apple ID can take over a victim's account without the victim doing anything. The other three issues are an MFA bypass for accounts whose password is already known (CVSS 8.1), a SAML assertion-audience bypass (CVSS 7.4) and an unauthenticated denial of service in the @logto/tunnel developer proxy (CVSS 7.5). The article reports no exploitation in the wild and no CVE ID yet. The fix is Logto 1.46.0, with @logto/connector-apple 1.6.11 and @logto/tunnel 0.3.12. Criticity is high rather than critical: the Apple and tunnel flaws are reachable without authentication, but the Apple case depends on a non-default connector, and no exploitation has been observed.
Technical Details
- Apple connector (GHSA-gfg4-7mg4-wpm2, CVSS 9.1): the connector read the user's email from an unsigned form field in preference to the signed ID token, so the person signing in can substitute any address (securityonline.info). An attacker can link their Apple ID to a victim's existing account or pre-register an account under the victim's address before the victim signs up. Affected: Logto 1.14.0 through 1.45.0 and @logto/connector-apple 1.2.0 through 1.6.10.
- MFA bypass (GHSA-m7px-7mj4-gj53, CVSS 8.1): MFA was enforced only on sign-in events. An attacker with a victim's password identifies as that user, then switches the interaction to registration, and the identified user is kept, so the flow completes without the second factor (securityonline.info). It applies even where MFA is mandatory. A related gap, GHSA-f78f-ghjf-hrx2, is fixed in the same release. Affected: Logto 1.45.0 and earlier.
- SAML audience bypass (GHSA-c475-vw46-2r98, CVSS 7.4): the SAML connector verified the signature but ignored the assertion's audience, so an assertion issued for another application can sign a user into Logto. Per the researcher, removing Logto from a user at the identity provider does not close this path (securityonline.info). Affected: Logto 1.12.0 through 1.45.0.
- Tunnel denial of service (GHSA-cr4j-qhrf-249w, CVSS 7.5): the static file proxy in @logto/tunnel trusted the end value of an HTTP Range header, and a very large value forces a read that Node.js cannot catch, so a single unauthenticated GET against a small file stops the tunnel. Affected: @logto/tunnel 0.3.11 and earlier.
The GitHub advisory pages, the Logto releases page and the fix pull requests could not be opened in this analysis, so the version ranges and CVSS values above rest on the article and on the release notes quoted below.
Remediation
- Upgrade Logto to 1.46.0, which the article says fixes the Apple, MFA and SAML issues. Its release notes, as quoted in a dependency-update pull request, describe security fixes for MFA, social and enterprise sign-in, the Account API and Logto Tunnel, and state that one of them needs admin action (github.com/Cloady/templates). Read that note before upgrading. The same notes list minimum Node.js versions of 22.23.4, 24.22.1 and 26.12.1 (github.com/Cloady/templates).
- Update @logto/connector-apple to 1.6.11 and @logto/tunnel to 0.3.12. The article says both reached npm on November 5.
- Until the upgrade, disable the Apple social connector. Set the sign-in mode to sign-in only to block the MFA bypass path, since that disables registration. Keep the tunnel bound to localhost during local UI testing.
- Review Apple-linked accounts created or linked before the upgrade. The article gives no interim mitigation for the SAML audience bypass, so the only protection there is the upgrade.