CVE-2026-63203

Vulnerability Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.

CVSS Score

Related Weaknesses (CWE)

References

• https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c22
• https://github.com/logto-io/logto/pull/9116
• https://github.com/logto-io/logto/releases/tag/v1.42.0
• https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf
• https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf