CVE-2026-54714

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.41.0

Description In the @logto/core package, the software fails to perform HTML-attribute escaping when reflecting the RelayState, SAMLResponse, and actionUrl variables into an auto-submit HTML form within the packages/core/src/saml-application/SamlApplication/utils.ts file. An attacker can use a crafted RelayState via the /api/saml/:id/authn endpoint (supporting GET or POST methods) to inject scripts that execute on the Logto tenant origin after a user completes the login process.

Recommendations Update to version 1.41.0.