Logto SSO Authentication Bypass via Missing MFA Enforcement

Executive Summary

This vulnerability in Logto allows users to bypass multi-factor authentication (MFA) during single sign-on (SSO) authentication. The issue occurs because the system does not enforce locally configured MFA requirements when switching between authentication flows, such as from sign-in to registration or password reset.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Logto authentication flow logs for irregular event transitions, such as unexpected switches between sign-in and registration flows or password reset attempts. Check if the setInteractionEvent method in experience-interaction.ts improperly handles event transitions without validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this flaw to gain unauthorized access to user accounts by bypassing MFA checks. This could lead to account takeover, privilege escalation, or unauthorized actions performed on behalf of legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication controls, such as GDPR's data protection principles or HIPAA's security rules. Failure to enforce MFA may result in unauthorized access to sensitive data, leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Logto to the latest patched version. Review and enforce strict validation in the setInteractionEvent method to prevent unauthorized event transitions. Clear profile data during flow switches and implement robust error handling for invalid transitions.

Useful 0 Not Useful 0