Summary
Logto contains an account linking flaw where email-based SSO identities can be associated with an existing account without proper verification.
By registering an identity at a permissive identity provider using a victim's email, an attacker may gain unauthorized access to that victim's Logto account when SSO is used.
Logto contains an account linking flaw where email-based SSO identities can be associated with an existing account without proper verification.
By registering an identity at a permissive identity provider using a victim's email, an attacker may gain unauthorized access to that victim's Logto account when SSO is used.
Affected context
This vulnerability appears in deployments where Logto integrates with one or more identity providers that permit registration of identities based solely on email ownership claims.
It is most relevant in environments that:
- Use email-based SSO flows for user login
- Allow new IdP identities to be linked to existing accounts
- Do not enforce strong, independent verification of email or identity before account linking
This vulnerability appears in deployments where Logto integrates with one or more identity providers that permit registration of identities based solely on email ownership claims.
It is most relevant in environments that:
- Use email-based SSO flows for user login
- Allow new IdP identities to be linked to existing accounts
- Do not enforce strong, independent verification of email or identity before account linking
Exploit preconditions
- Attack surface: Public-facing SSO login and account linking endpoints
- Required access: Ability to create or control an identity at a permissive IdP using the victim's email address
- Trigger point: Initiating an SSO login and allowing the unverified IdP identity to be linked to the victim's Logto account
- Why exploitation is possible: Logto trusts the email claim from the IdP during account linking without adequately verifying that the IdP identity is legitimately controlled by the same person as the existing account owner
- Attack surface: Public-facing SSO login and account linking endpoints
- Required access: Ability to create or control an identity at a permissive IdP using the victim's email address
- Trigger point: Initiating an SSO login and allowing the unverified IdP identity to be linked to the victim's Logto account
- Why exploitation is possible: Logto trusts the email claim from the IdP during account linking without adequately verifying that the IdP identity is legitimately controlled by the same person as the existing account owner
Why this happens
The underlying issue is an authentication verification weakness aligned with CWE-287: Improper Authentication.
Logto's logic for linking SSO identities to existing accounts relies on email-based assertions from external identity providers without enforcing robust verification that the linking request is initiated by the legitimate account owner.
Conceptually, the system conflates matching email attributes with proof of identity, allowing attackers to register identities at permissive IdPs using a victim's email and have those identities treated as equivalent to the victim's authenticated account.
The underlying issue is an authentication verification weakness aligned with CWE-287: Improper Authentication.
Logto's logic for linking SSO identities to existing accounts relies on email-based assertions from external identity providers without enforcing robust verification that the linking request is initiated by the legitimate account owner.
Conceptually, the system conflates matching email attributes with proof of identity, allowing attackers to register identities at permissive IdPs using a victim's email and have those identities treated as equivalent to the victim's authenticated account.
Potential impact
- An attacker may gain full access to a victim's Logto account via SSO
- Sensitive data associated with the victim's account could be exposed or modified
- Application-level permissions tied to the victim's identity may be abused
- Further compromise of downstream services that rely on Logto for authentication could occur
- An attacker may gain full access to a victim's Logto account via SSO
- Sensitive data associated with the victim's account could be exposed or modified
- Application-level permissions tied to the victim's identity may be abused
- Further compromise of downstream services that rely on Logto for authentication could occur
General mitigation guidance
Mitigation typically focuses on tightening the authentication and account linking model around SSO flows.
Useful patterns include:
- Requiring explicit user-initiated confirmation (e.g., out-of-band verification) before linking new IdP identities to an existing account
- Treating email address matches as a hint, not as sufficient proof of identity, and layering additional checks such as verified login sessions or multi-factor authentication
- Restricting which IdPs can participate in account linking and enforcing stricter trust and validation policies for those providers
- Designing account linking processes to be secure by default, favoring opt-in, high-assurance linking rather than implicit association based on shared attributes
Mitigation typically focuses on tightening the authentication and account linking model around SSO flows.
Useful patterns include:
- Requiring explicit user-initiated confirmation (e.g., out-of-band verification) before linking new IdP identities to an existing account
- Treating email address matches as a hint, not as sufficient proof of identity, and layering additional checks such as verified login sessions or multi-factor authentication
- Restricting which IdPs can participate in account linking and enforcing stricter trust and validation policies for those providers
- Designing account linking processes to be secure by default, favoring opt-in, high-assurance linking rather than implicit association based on shared attributes
How teams detect issues like this
Detection efforts can focus on how identities are linked and authenticated during SSO flows.
Organizations may:
- Review account linking code paths to ensure they do not rely solely on email or basic profile attributes as proof of identity
- Employ static or policy-based checks to flag logic that automatically binds external identities to existing accounts without strong verification
- Analyze authentication and audit logs for anomalous patterns, such as multiple identities with similar emails being linked or sudden SSO-based access to dormant accounts
- Use automated security review tools to highlight places where authentication decisions are made based on weak or indirect signals
Detection efforts can focus on how identities are linked and authenticated during SSO flows.
Organizations may:
- Review account linking code paths to ensure they do not rely solely on email or basic profile attributes as proof of identity
- Employ static or policy-based checks to flag logic that automatically binds external identities to existing accounts without strong verification
- Analyze authentication and audit logs for anomalous patterns, such as multiple identities with similar emails being linked or sudden SSO-based access to dormant accounts
- Use automated security review tools to highlight places where authentication decisions are made based on weak or indirect signals
