CVE-2026-54714

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54714", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T22:58:06.564Z", "datePublished": "2026-07-10T19:54:28.526Z", "dateUpdated": "2026-07-13T18:18:36.103Z"}, "containers": {"cna": {"title": "Logto: XSS via unescaped RelayState in SAML auto-submit form", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f"}, {"name": "https://github.com/logto-io/logto/pull/9008", "tags": ["x_refsource_MISC"], "url": "https://github.com/logto-io/logto/pull/9008"}, {"name": "https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e", "tags": ["x_refsource_MISC"], "url": "https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e"}, {"name": "https://github.com/logto-io/logto/releases/tag/v1.41.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/logto-io/logto/releases/tag/v1.41.0"}], "affected": [{"vendor": "logto-io", "product": "logto", "versions": [{"version": "< 1.41.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T19:54:28.526Z"}, "descriptions": [{"lang": "en", "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0."}], "source": {"advisory": "GHSA-cpm5-w86q-w85f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:18:29.074854Z", "id": "CVE-2026-54714", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:18:36.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:18:29.074854Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:18:32.829Z"}}], "cna": {"title": "Logto: XSS via unescaped RelayState in SAML auto-submit form", "source": {"advisory": "GHSA-cpm5-w86q-w85f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "logto-io", "product": "logto", "versions": [{"status": "affected", "version": "< 1.41.0"}]}], "references": [{"url": "https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f", "name": "https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/logto-io/logto/pull/9008", "name": "https://github.com/logto-io/logto/pull/9008", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e", "name": "https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/logto-io/logto/releases/tag/v1.41.0", "name": "https://github.com/logto-io/logto/releases/tag/v1.41.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T19:54:28.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54714", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:18:36.103Z", "dateReserved": "2026-06-15T22:58:06.564Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T19:54:28.526Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "logto", "vendor": "logto-io", "versions": [{"status": "affected", "version": "< 1.41.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0."}, {"lang": "es", "value": "Logto es la moderna infraestructura de autenticaci\u00f3n de c\u00f3digo abierto para aplicaciones SaaS y de IA. Antes de la versi\u00f3n 1.41.0, @logto/core reflejaba el SAML RelayState, SAMLResponse y actionUrl en un formulario HTML de autoenv\u00edo con origen Logto en packages/core/src/saml-application/SamlApplication/utils.ts sin el escape de atributos HTML. Un flujo de aplicaci\u00f3n SAML con un RelayState manipulado desde GET o POST /API/saml/:id/authn podr\u00eda inyectar un script que se ejecuta en el origen del inquilino de Logto despu\u00e9s de que el usuario completa el inicio de sesi\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 1.41.0."}], "id": "CVE-2026-54714", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54714", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T18:18:29.074854Z", "version": "2.0.3"}}]}, "published": "2026-07-10T20:16:46.173", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e"}, {"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/pull/9008"}, {"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/releases/tag/v1.41.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/security/advisories/GHSA-cpm5-w86q-w85f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "logto", "source": "cna", "vendor": "logto-io"}, "product": "logto", "vendor": "logto-io"}], "created": "2026-07-11T10:30:05.155720+00:00", "updated": "2026-08-01T12:15:03.441365+00:00", "vendors": ["logto-io", "logto-io$PRODUCT$logto"]}