CVE-2026-54714

{
  "id": "CVE-2026-54714",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-10T20:16:46.173",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0."
    },
    {
      "lang": "es",
      "value": "Logto es la moderna infraestructura de autenticación de código abierto para aplicaciones SaaS y de IA. Antes de la versión 1.41.0, @logto/core reflejaba el SAML RelayState, SAMLResponse y actionUrl en un formulario HTML de autoenvío con origen Logto en packages/core/src/saml-application/SamlApplication/utils.ts sin el escape de atributos HTML. Un flujo de aplicación SAML con un RelayState manipulado desde GET o POST /API/saml/:id/authn podría inyectar un script que se ejecuta en el origen del inquilino de Logto después de que el usuario completa el inicio de sesión. Este problema está solucionado en la versión 1.41.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "logto-io",
          "product": "logto",
          "versions": [
            {
              "version": "< 1.41.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T18:18:29.074854Z",
          "id": "CVE-2026-54714",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/logto-io/logto/pull/9008",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/logto-io/logto/releases/tag/v1.41.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f",
      "source": "[email protected]"
    }
  ]
}