CVE-2026-63203

Name of the Vulnerable Software and Affected Versions Logto versions 1.31.0 through 1.41.0

Description Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller with a same-user access token containing only the openid scope to retrieve stored social or enterprise SSO provider access tokens. This occurs because the handlers authenticate the user but fail to require the identities scope, which is intended to protect identity-detail operations, thereby bypassing the Account API consent boundary. This issue can be exploited if federated token-set storage is enabled and the user has authenticated via a supported connector, allowing a low-trust application to use the disclosed provider token against upstream APIs. The affected endpoints are 'GET /api/my-account/identities/{target}/access-token' and 'GET /api/my-account/sso-identities/{connectorId}/access-token'.

Recommendations Update to version 1.42.0.