Horizon Alert
Summary of the vulnerability and why it matters
This issue in Logto allows attackers to link a victim's email to a new account using a permissive identity provider, potentially granting unauthorized access to the victim's account. The technology affected is identity and access management. The main concern is confirming relevance and exposure due to the potential for unauthorized account access.
- Unverified email linking can hijack user accounts.
- Critical for identity services; confirm if used.
- Assess if Logto manages your user identities.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by using a victim's email address to register an account with a freely accessible identity provider. Once registered, the attacker can then link this identity to the victim's Logto account, effectively taking over their access without needing any prior credentials or interaction from the victim. This could lead to unauthorized access and modification of the victim's data or services.
- Requires network access.
- Unverified email links accounts.
- Unauthorized account access.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker could link a victim's email to a rogue identity at a permissive identity provider, potentially gaining unauthorized access to the victim's account. This could impact system data and user data through unauthorized access.
- Account access and user data at risk.
- Unverified email linking enables unauthorized access.
- Unauthorized access to accounts and data.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Logto, which allows unverified email-based SSO account linking, could be exploited by an attacker to gain unauthorized access to user accounts. Ownership of the remediation effort likely falls to the platform or identity and access management (IAM) team responsible for the Logto deployment, in coordination with application owners who rely on it for authentication. The immediate first step is to identify all instances of Logto within the environment, assess their reachability and criticality, and confirm the accountable owner for each.
- Platform/IAM team owns the issue.
- Verify Logto instances and exposure.
- Plan remediation based on risk.
