CVE-2026-62317 logto-io CVE debrief

Who should care

Organizations using Logto for authentication, particularly those with high-security requirements, should prioritize updating to version 1.41.0 to prevent potential catastrophic backtracking attacks. Additionally, security teams and vulnerability management teams should review the CVE record and assess their exposure to this vulnerability.

Technical summary

The Logto email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used an attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, allowing for catastrophic backtracking in subaddressingRegex.test(email). This vulnerability can be mitigated by updating to version 1.41.0, which fixes the issue.

Defensive priority

Organizations using Logto for authentication should prioritize updating to version 1.41.0 to prevent potential catastrophic backtracking attacks.

Recommended defensive actions

• Update Logto to version 1.41.0 or later
• Review and restrict email input to prevent similar vulnerabilities
• Monitor authentication and token issuance for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates that Logto's email subaddressing blocklist was vulnerable to catastrophic backtracking due to a permissive emailRegEx. The issue is fixed in version 1.41.0. To verify, defenders should review the email subaddressing blocklist configuration and ensure that it is properly updated to prevent similar vulnerabilities. Additionally, defenders should monitor authentication and token issuance for potential issues. The CVE record also notes that the vulnerability was caused by an attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled.

Official resources