CVE-2026-55370

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window = 1 and did not persist or compare the accepted TOTP time-step counter. An attacker who has the victim's first factor and captures a live TOTP value can replay that value to satisfy MFA during the same acceptance window. This issue is fixed in version 1.41.0.

• CWE-294

• https://github.com/logto-io/logto/commit/9118867f6cbadc7291cf913beb4fede91ed5d374
• https://github.com/logto-io/logto/pull/9109
• https://github.com/logto-io/logto/releases/tag/v1.41.0
• https://github.com/logto-io/logto/security/advisories/GHSA-6wj7-c66m-6c82

Published

Jul 10, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5532A vulnerability was found in ScrapeGraphAI scrapegraph-ai up…6.3
• CVE-2026-5533A vulnerability was determined in badlogic pi-mono 0.58.4. T…4.3
• CVE-2026-5534A vulnerability was identified in itsourcecode Online Enroll…7.3
• CVE-2026-5535A security flaw has been discovered in FedML-AI FedML up to …5.4
• CVE-2026-5536A weakness has been identified in FedML-AI FedML up to 0.8.9…7.3
• CVE-2026-5537A security vulnerability has been detected in halex CourseSE…6.3
• CVE-2026-55377Logto is the modern, open-source auth infrastructure for Saa…8.1
• CVE-2026-55379Pillow is a Python imaging library. Prior to 12.3.0, PIL/Bdf…7.5
• CVE-2026-5538A vulnerability was detected in QingdaoU OnlineJudge up to 1…6.3
• CVE-2026-55380Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdI…7.5
• CVE-2026-55388piscina is a node.js worker pool implementation. Prior to 6.…8.1
• CVE-2026-55389datamodel-code-generator generates Pydantic v2 models, datac…7.5