{"id":"CVE-2026-63203","title":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps","summary":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with …","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cwe":["CWE-862"],"vendor":"logto-io","product":"logto","affected":["logto >= 1.31.0, < 1.42.0"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T16:17:08.837","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63203","references":[{"url":"https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c224","label":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/pull/9116","label":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.42.0","label":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf","label":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-24T15:47:15.549514Z"},"ingestedAt":"2026-09-24T15:45:56.667Z","slug":"CVE-2026-63203","body":"## Overview\n\nLogto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":210286,"id":"CVE-2026-63203","ts":1790268476340,"field":"exploit_available","old":"false","new":"true"}]}