CVE-2026-119420 in Lago
Summary
by MITRE • 10/30/2026
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Lago versions through 1.55.0 represents a critical authentication bypass flaw within the application’s invitation acceptance workflow. This security defect specifically impacts organization administrators who possess the capability to invite new users or manage existing accounts via the acceptInvite mutation endpoint. The core technical failure lies in the absence of mandatory password verification during this specific operation, allowing an attacker with administrative privileges to manipulate session tokens for pre-existing user accounts without knowing their actual credentials. By exploiting this logic error, a malicious actor can effectively hijack sessions belonging to other users within the same organization, thereby bypassing standard authentication controls that are designed to verify identity through secret knowledge such as passwords.
From a technical perspective, the flaw resides in how the backend processes the acceptInvite mutation when applied to accounts that already exist in the database rather than creating new ones. In many modern web applications, inviting an existing user is intended to re-invite them or update their role without altering their authentication state. However, Lago’s implementation incorrectly treats this action as a credential reset or session initialization event where it generates and returns a JSON Web Token (JWT) for the target account immediately upon acceptance of the invitation. Crucially, this process does not require the administrator to provide or verify the victim's current password nor enforce a new strong password policy before issuing the token. This design oversight allows an attacker who has compromised an administrative account to simply invite their own email address associated with the victim’s identity and accept that invitation using any arbitrary password string provided by the attack script, resulting in the immediate issuance of a valid session token for the victim's account.
The operational impact of this vulnerability is severe due to the high level of access granted through organization administration roles. Once an attacker obtains a valid JWT via this method, they gain full authenticated access to the victim’s organizational environment. This includes unrestricted visibility and modification capabilities regarding sensitive billing data, which may contain credit card numbers, bank account details, and invoice histories essential for financial fraud or extortion. Furthermore, attackers can access API keys that serve as credentials for integrations with third-party services such as payment gateways like Stripe or Twilio, potentially allowing them to initiate unauthorized transactions, exfiltrate customer PII (Personally Identifiable Information), or disrupt service availability by deleting critical configurations. The ability to impersonate an organization administrator also means the attacker can escalate privileges further within the platform, creating backdoors that persist even after the initial vulnerability is patched if not properly audited and rotated.
This incident aligns with CWE-287 Improper Authentication, specifically illustrating a failure in verifying credentials during account management operations. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate user accounts to maintain persistence and move laterally within an environment without triggering typical intrusion detection systems that look for brute-force or credential stuffing patterns. Because the attack utilizes valid administrative functions of the application, it may evade basic anomaly detection based on login frequency from unknown locations if the attacker operates from a trusted IP range associated with the organization.
To mitigate this vulnerability and prevent similar issues in future development cycles, immediate remediation involves upgrading Lago to version 1.56.0 or later where this logic error has been addressed by enforcing strict password verification during the acceptInvite process for existing users. For organizations currently running vulnerable versions, it is imperative to rotate all API keys and payment integration credentials immediately upon detection of potential compromise, as these tokens may have already been exfiltrated. Additionally, implementing multi-factor authentication (MFA) for administrative accounts adds a critical layer of defense that would prevent session hijacking even if an administrator’s password or JWT is compromised. Security teams should also audit invitation logs to identify any suspicious acceptInvite activities involving existing user emails and ensure that future development adheres to the principle of least privilege, ensuring that account management operations do not inadvertently grant elevated access without rigorous identity verification steps consistent with industry standards for secure session handling.