Logto Principal Collision via Email Identifier Normalization Bypass

Executive Summary

This vulnerability involves Logto not normalizing email and identifier strings during principal lookup. This allows attackers to exploit case differences or Unicode variations to create colliding identities, potentially gaining unauthorized account access.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves principal collision due to improper normalization of email and identifier strings in Logto's SSO verification. To detect it, inspect Logto's SSO guard implementation for functions like verifySsoOnlyEmailIdentifier and check if email domains are properly normalized before SSO enforcement.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate a legitimate user by using a different case or Unicode variation of their email or identifier, bypassing authentication and accessing unauthorized accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA, which mandate strict access controls and protection of personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Review and update Logto SSO configurations to ensure proper email normalization. Check for duplicate accounts created via case or Unicode variations. Enforce strict email domain validation in SSO connectors.

Useful 0 Not Useful 0