CVE-2026-55370

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.41.0

Description TOTP verification allows the reuse of a successfully used TOTP code as long as it remains within the RFC 6238 acceptance window. This occurs because the verifier utilizes a stateless check from the otplib library with window = 1 and fails to persist or compare the accepted TOTP time-step counter. An attacker possessing the victim's first factor and a captured live TOTP value can replay that value to bypass multi-factor authentication during the same acceptance window.

Recommendations Update to version 1.41.0.