CyberRota Analysis
AI-GeneratedThe vulnerability affects the Logto authentication infrastructure, specifically in versions prior to 1.41.0, where insufficient HTML-attribute escaping allows for the injection of malicious scripts via crafted SAML RelayState parameters. This could lead to cross-site scripting (XSS) attacks, potentially compromising user sessions after login. Organizations utilizing Logto for their SaaS and AI applications should prioritize upgrading to version 1.41.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0.