CVE-2026-62317 in Logto
Summary
by MITRE • 08/19/2026
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Logto versions prior to 1.41.0 represents a critical Regular Expression Denial of Service (ReDoS) flaw within its authentication infrastructure, specifically affecting the email subaddressing blocklist functionality. As an open-source identity provider designed for SaaS and AI applications, Logto handles sensitive user data and authentication flows where availability is paramount. The core technical defect resides in the file packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts, which manages how email addresses are validated against a blocklist when subaddressing restrictions are enabled. Subaddressing, also known as plus addressing or aliasing, allows users to append additional characters after an at sign (e.g., [email protected]) to filter incoming mail. The system attempts to detect and potentially block such patterns using a regular expression constructed dynamically based on the domain provided in the email input field.
The fundamental flaw stems from the interaction between two distinct validation mechanisms: the general email format validator, defined as emailRegEx, and the specific subaddressing pattern matcher, referred to as subaddressingRegex. The emailRegEx is configured with permissive rules that allow for multiple at signs within a single string and do not strictly limit the complexity of characters allowed in local parts or domains. When an attacker submits a crafted payload containing carefully constructed regular expression metacharacters alongside multiple at signs, the system proceeds to test this input against subaddressingRegex using the .test() method. Because the regex engine employed by Node.js uses backtracking algorithms for pattern matching, inputs designed with nested quantifiers or ambiguous patterns can trigger catastrophic backtracking. This phenomenon causes the CPU usage to spike exponentially as the engine attempts every possible combination of matches before concluding that no valid match exists, effectively stalling the JavaScript event loop.
The operational impact of this vulnerability is severe due to its direct effect on the application's availability and integrity. Since Node.js operates on a single-threaded event loop model, any operation that blocks this loop prevents all other asynchronous operations from executing. In the context of Logto, this means that requests for authentication tokens, Single Sign-On (SSO) assertions, and administrative console interactions are halted until the malicious request completes or times out. An unauthenticated attacker can exploit POST /api/experience/verification/verification-code to trigger this condition remotely without valid credentials. This results in a denial of service where legitimate users cannot log in, obtain tokens, or access their accounts, effectively rendering the authentication infrastructure unusable for all tenants relying on the instance.
From a classification perspective, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption and more specifically CWE-1335: Regular Expression Denial of Service (ReDoS). It also maps to MITRE ATT&CK technique T1496: Resource Hijacking, as the attacker consumes computational resources to disrupt service availability. The root cause is a failure in input validation and regex construction logic, where user-supplied data directly influences the structure or complexity of regular expressions used for security checks without adequate safeguards against pathological inputs.
To mitigate this vulnerability, organizations running Logto must upgrade immediately to version 1.41.0 or later, which contains patches that address the permissive nature of emailRegEx and optimize subaddressingRegex construction to prevent catastrophic backtracking scenarios. For environments where an immediate upgrade is not feasible, temporary mitigations include implementing a Web Application Firewall (WAF) rule set designed to detect and block HTTP POST requests containing patterns indicative of ReDoS attacks, such as strings with excessive repetition or nested quantifiers in email fields. Additionally, enforcing strict input length limits on the email field can reduce the attack surface by preventing the submission of overly long payloads that are necessary for triggering exponential backtracking behavior. Regular security audits focusing on regex construction from user inputs should be conducted to prevent similar issues in other parts of the application logic.