CVE-2026-62317

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.

• CWE-1333

• https://github.com/logto-io/logto/commit/021381237511bc0d42f81d65df8b036b01f40547
• https://github.com/logto-io/logto/pull/9106
• https://github.com/logto-io/logto/releases/tag/v1.41.0
• https://github.com/logto-io/logto/security/advisories/GHSA-qp7j-c3q2-g739
• https://github.com/logto-io/logto/security/advisories/GHSA-qp7j-c3q2-g739

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6231The bson_validate function may return early on specific inpu…7.5
• CVE-2026-623129Router is an AI router & token saver. Prior to 0.5.2, 9Rout…8.8
• CVE-2026-62313Incus is a system container and virtual machine manager. Pri…4.3
• CVE-2026-62314Anubis is a Web AI Firewall Utility that challenges users' c…5.8
• CVE-2026-62315Frappe is a full-stack web application framework. In version…7.1
• CVE-2026-62316Microsoft UFO open-source framework for intelligent automati…8.8
• CVE-2026-62323Cloudreve is a self-hosted file management and sharing syste…6.3
• CVE-2026-62324Jodit Editor is a WYSIWYG editor with a built-in file browse…5.4
• CVE-2026-62325goshs is a feature-rich single-binary file server for red te…9.1
• CVE-2026-62326Weblate is a web-based continuous localization platform used…6.5
• CVE-2026-623279Router through version 0.4.41 contains an unauthenticated i…9.3
• CVE-2026-623289Router through version 0.4.41 contain an unauthenticated in…8.7