Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability involves a bypass in how Logto handles authentication tokens, potentially allowing an attacker to reuse old tokens to gain unauthorized access. It affects identity and access management systems that use Logto's authentication capabilities, impacting the security of user sessions and access controls. The primary concern is to confirm if our environment is affected and understand the potential exposure.
- Authentication tokens can be replayed.
- Protects against unauthorized access to systems.
- Confirm relevance and exposure to our systems.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending a crafted authentication request to a Logto instance that fails to properly validate the nonce claim in an ID token. This could allow an attacker to replay a previously issued authentication token, potentially impersonating a legitimate user and gaining unauthorized access to their session. The risk is amplified because the vulnerability is network-accessible and requires no privileges.
- No privileges or user interaction needed.
- Bypasses OIDC nonce validation.
- Replay authentication tokens.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to replay authentication tokens, weakening the security of user sessions. This occurs when the Logto OpenID Connect (OIDC) implementation bypasses nonce validation, specifically when the nonce claim is missing from the ID token, thereby enabling the reuse of previously issued tokens.
- Authentication tokens.
- Replay of absent nonce tokens.
- Compromised user sessions.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Logto's OIDC nonce validation, allowing for replay attacks, primarily impacts platform and security teams responsible for identity management. The first practical step is to identify all Logto deployments, assess their internet reachability and business criticality, and then determine the accountable owner for remediation.
- Platform and security teams own the issue.
- Verify Logto's internet exposure and criticality.
- Plan remediation based on identified risk.
