Authentication Bypass in Lago via acceptInvite Mutation

Executive Summary

CVE-2026-119420 is an authentication bypass vulnerability in Lago through version 1.55.0. It allows attackers to gain unauthorized access to user accounts by exploiting the GraphQL acceptInvite mutation. The flaw permits accepting an invitation without a password check, enabling attackers to invite a victim's email, accept with an arbitrary password, and receive a JWT session token. This token grants access to the victim's organizations, billing data, API keys, and payment integrations.

Useful 0 Not Useful 0

Impact Analysis

If you are a Lago user, an attacker could exploit this vulnerability to gain access to your organizations, billing information, API keys, and payment integrations. This could lead to financial loss, data breaches, or unauthorized actions performed on your behalf. The vulnerability requires the attacker to know your email and control an organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using Lago must ensure proper access controls and audit logging to maintain compliance. The exposure of billing data and API keys may also violate contractual or regulatory obligations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Lago to a version that includes the security fix for the acceptInvite mutation, which now requires password verification for existing users.
• Review and revoke any suspicious JWT tokens issued before the fix was applied to prevent unauthorized access.
• Monitor for unusual activity in billing data, API keys, and payment integrations, especially for accounts that accepted invitations without password checks.

Useful 0 Not Useful 0