CyberRota Analysis
AI-GeneratedLogto's self-hosted SAML application IdP prior to version 1.41.0 is vulnerable due to improper handling of user-controlled profile attributes, allowing authenticated low-privilege users to inject XML markup into SAML responses. This can lead to privilege escalation at relying Service Providers that depend on SAML attributes for authorization. Organizations using affected versions of Logto should prioritize this vulnerability to prevent potential unauthorized access and escalation of privileges within their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders unescaped. An authenticated low-privilege user could place XML markup in a profile attribute so Logto signed a forged SAML attribute, such as an arbitrary role, allowing privilege escalation at relying Service Providers that authorize on SAML attributes. This issue is fixed in version 1.41.0.