CVE-2026-55789

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55789", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T14:40:28.380Z", "datePublished": "2026-07-10T19:55:37.360Z", "dateUpdated": "2026-07-13T18:16:18.449Z"}, "containers": {"cna": {"title": "Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers", "problemTypes": [{"descriptions": [{"cweId": "CWE-91", "lang": "en", "description": "CWE-91: XML Injection (aka Blind XPath Injection)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1395", "lang": "en", "description": "CWE-1395: Dependency on Vulnerable Third-Party Component", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63"}, {"name": "https://github.com/logto-io/logto/pull/9107", "tags": ["x_refsource_MISC"], "url": "https://github.com/logto-io/logto/pull/9107"}, {"name": "https://github.com/logto-io/logto/commit/9097054860f0d638d90778d3dcde2ba050b844b6", "tags": ["x_refsource_MISC"], "url": "https://github.com/logto-io/logto/commit/9097054860f0d638d90778d3dcde2ba050b844b6"}, {"name": "https://github.com/logto-io/logto/releases/tag/v1.41.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/logto-io/logto/releases/tag/v1.41.0"}], "affected": [{"vendor": "logto-io", "product": "logto", "versions": [{"version": "< 1.41.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T19:55:37.360Z"}, "descriptions": [{"lang": "en", "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders unescaped. An authenticated low-privilege user could place XML markup in a profile attribute so Logto signed a forged SAML attribute, such as an arbitrary role, allowing privilege escalation at relying Service Providers that authorize on SAML attributes. This issue is fixed in version 1.41.0."}], "source": {"advisory": "GHSA-vfpw-vq44-4p63", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:16:09.500167Z", "id": "CVE-2026-55789", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:16:18.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55789", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:16:09.500167Z"}}}], "references": [{"url": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:15:52.750Z"}}], "cna": {"title": "Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers", "source": {"advisory": "GHSA-vfpw-vq44-4p63", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "logto-io", "product": "logto", "versions": [{"status": "affected", "version": "< 1.41.0"}]}], "references": [{"url": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63", "name": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/logto-io/logto/pull/9107", "name": "https://github.com/logto-io/logto/pull/9107", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/logto-io/logto/commit/9097054860f0d638d90778d3dcde2ba050b844b6", "name": "https://github.com/logto-io/logto/commit/9097054860f0d638d90778d3dcde2ba050b844b6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/logto-io/logto/releases/tag/v1.41.0", "name": "https://github.com/logto-io/logto/releases/tag/v1.41.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders unescaped. An authenticated low-privilege user could place XML markup in a profile attribute so Logto signed a forged SAML attribute, such as an arbitrary role, allowing privilege escalation at relying Service Providers that authorize on SAML attributes. This issue is fixed in version 1.41.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-91", "description": "CWE-91: XML Injection (aka Blind XPath Injection)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1395", "description": "CWE-1395: Dependency on Vulnerable Third-Party Component"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T19:55:37.360Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55789", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:16:18.449Z", "dateReserved": "2026-06-17T14:40:28.380Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T19:55:37.360Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "logto", "vendor": "logto-io", "versions": [{"status": "affected", "version": "< 1.41.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders unescaped. An authenticated low-privilege user could place XML markup in a profile attribute so Logto signed a forged SAML attribute, such as an arbitrary role, allowing privilege escalation at relying Service Providers that authorize on SAML attributes. This issue is fixed in version 1.41.0."}, {"lang": "es", "value": "Logto es la moderna infraestructura de autenticaci\u00f3n de c\u00f3digo abierto para aplicaciones SaaS y de IA. Antes de la versi\u00f3n 1.41.0, el IdP de aplicaci\u00f3n SAML autoalojado de Logto constru\u00eda la respuesta y aserci\u00f3n SAML firmadas sustituyendo cadenas de atributos de perfil controlados por el usuario, como nombre, correo electr\u00f3nico y valores de mapeo de atributos personalizados, en marcadores de posici\u00f3n de texto de elementos de una plantilla XML SAML utilizando samlify 2.10.0, lo que dejaba esos marcadores de posici\u00f3n sin escapar. Un usuario autenticado con bajos privilegios pod\u00eda insertar marcado XML en un atributo de perfil, de modo que Logto firmaba un atributo SAML falsificado, como un rol arbitrario, permitiendo la escalada de privilegios en los Proveedores de Servicios de confianza que autorizan bas\u00e1ndose en atributos SAML. Este problema est\u00e1 solucionado en la versi\u00f3n 1.41.0."}], "id": "CVE-2026-55789", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55789", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T18:16:09.500167Z", "version": "2.0.3"}}]}, "published": "2026-07-10T20:16:47.933", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/commit/9097054860f0d638d90778d3dcde2ba050b844b6"}, {"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/pull/9107"}, {"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/releases/tag/v1.41.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/logto-io/logto/security/advisories/GHSA-vfpw-vq44-4p63"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-91"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "logto", "source": "cna", "vendor": "logto-io"}, "product": "logto", "vendor": "logto-io"}], "created": "2026-07-11T18:15:05.121669+00:00", "updated": "2026-08-01T12:15:03.440892+00:00", "vendors": ["logto-io", "logto-io$PRODUCT$logto"]}