Logto up to 1.40.x Email Blocklist Policy email-blocklist-policy.ts incorrect regex

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Logto up to 1.40.x. This affects an unknown function of the file packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts of the component Email Blocklist Policy. The manipulation leads to incorrect regex. This vulnerability is documented as CVE-2026-62317. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Logto up to 1.40.x. This issue affects an unknown functionality of the file packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts of the component Email Blocklist Policy. The manipulation with an unknown input leads to a incorrect regex vulnerability. Using CWE to declare the problem leads to CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. Impacted is availability. The summary by CVE is:

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-62317 since 07/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 1.41.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-62757). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Logto

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion