Summary
Logto fails to enforce locally configured multi-factor authentication (MFA) during single sign-on (SSO) authentication flows.
Under certain integration setups, users can complete SSO without being challenged for their second factor, which can lead to unauthorized account access where MFA is expected.
Logto fails to enforce locally configured multi-factor authentication (MFA) during single sign-on (SSO) authentication flows.
Under certain integration setups, users can complete SSO without being challenged for their second factor, which can lead to unauthorized account access where MFA is expected.
Affected context
This vulnerability occurs in deployments where Logto is used as an identity provider or authentication broker and MFA policies are configured locally.
It is most relevant when:
- MFA is required for direct Logto login
- SSO integrations are enabled to federated identity providers
- Relying applications assume that Logto enforces MFA consistently across all login paths
In those environments, inconsistent enforcement across SSO flows can weaken the overall authentication posture.
This vulnerability occurs in deployments where Logto is used as an identity provider or authentication broker and MFA policies are configured locally.
It is most relevant when:
- MFA is required for direct Logto login
- SSO integrations are enabled to federated identity providers
- Relying applications assume that Logto enforces MFA consistently across all login paths
In those environments, inconsistent enforcement across SSO flows can weaken the overall authentication posture.
Exploit preconditions
- Attack surface: Authentication endpoints used for SSO-based logins
- Required access: Ability to initiate an SSO authentication flow for a target account (e.g., valid primary credentials or existing SSO access)
- Trigger point: Completing SSO authentication where the MFA requirement should be applied but is not enforced
- Why exploitation is possible: The MFA enforcement logic is bound to the direct login path and not consistently applied to SSO flows, leading to an authentication bypass (CWE-308).
- Attack surface: Authentication endpoints used for SSO-based logins
- Required access: Ability to initiate an SSO authentication flow for a target account (e.g., valid primary credentials or existing SSO access)
- Trigger point: Completing SSO authentication where the MFA requirement should be applied but is not enforced
- Why exploitation is possible: The MFA enforcement logic is bound to the direct login path and not consistently applied to SSO flows, leading to an authentication bypass (CWE-308).
Why this happens
The underlying issue is an inconsistent application of authentication policy across different login flows.
MFA requirements are enforced for some authentication paths (such as local username/password) but omitted or ignored when users authenticate via SSO.
This maps to CWE-308: Use of Single-Factor Authentication, where a second factor is expected by policy but not actually required or enforced, resulting in an effective downgrade from multi-factor to single-factor authentication.
The underlying issue is an inconsistent application of authentication policy across different login flows.
MFA requirements are enforced for some authentication paths (such as local username/password) but omitted or ignored when users authenticate via SSO.
This maps to CWE-308: Use of Single-Factor Authentication, where a second factor is expected by policy but not actually required or enforced, resulting in an effective downgrade from multi-factor to single-factor authentication.
Potential impact
- Users may gain access to accounts without completing configured MFA challenges
- Attackers with primary credentials can bypass MFA by using SSO flows
- Compromise of sensitive applications that rely on Logto to enforce strong authentication
- Reduction of overall trust in centralized identity and access management policies
- Users may gain access to accounts without completing configured MFA challenges
- Attackers with primary credentials can bypass MFA by using SSO flows
- Compromise of sensitive applications that rely on Logto to enforce strong authentication
- Reduction of overall trust in centralized identity and access management policies
General mitigation guidance
Effective mitigation focuses on aligning authentication policies across all login paths and enforcing MFA consistently.
Common defensive patterns include:
- Centralizing MFA enforcement logic so it is applied uniformly to both local and SSO authentication flows
- Treating SSO and direct logins as equivalent in policy evaluation, ensuring no implicit downgrade in assurance level
- Implementing risk-based or step-up authentication that re-checks MFA when accessing sensitive resources, regardless of initial login method
- Designing default configurations to favor strong authentication, with clear visibility into which flows are MFA-protected
These approaches help ensure that SSO integrations do not weaken the overall security posture.
Effective mitigation focuses on aligning authentication policies across all login paths and enforcing MFA consistently.
Common defensive patterns include:
- Centralizing MFA enforcement logic so it is applied uniformly to both local and SSO authentication flows
- Treating SSO and direct logins as equivalent in policy evaluation, ensuring no implicit downgrade in assurance level
- Implementing risk-based or step-up authentication that re-checks MFA when accessing sensitive resources, regardless of initial login method
- Designing default configurations to favor strong authentication, with clear visibility into which flows are MFA-protected
These approaches help ensure that SSO integrations do not weaken the overall security posture.
How teams detect issues like this
Organizations can identify similar issues through:
- Policy reviews comparing MFA requirements across local and federated login flows
- Targeted tests where users attempt SSO logins to high-value applications and confirm that MFA challenges occur as expected
- Configuration audits verifying that identity provider and service provider settings consistently require MFA
- Automated checks or identity governance tools that flag flows authenticated with weaker assurance levels than policy dictates
Security-focused code reviews and integration testing around authentication and MFA logic are particularly effective in catching inconsistent enforcement.
Organizations can identify similar issues through:
- Policy reviews comparing MFA requirements across local and federated login flows
- Targeted tests where users attempt SSO logins to high-value applications and confirm that MFA challenges occur as expected
- Configuration audits verifying that identity provider and service provider settings consistently require MFA
- Automated checks or identity governance tools that flag flows authenticated with weaker assurance levels than policy dictates
Security-focused code reviews and integration testing around authentication and MFA logic are particularly effective in catching inconsistent enforcement.
