CVE-2026-54714: Logto SAML XSS Vulnerability

CVE-2026-54714 Overview

CVE-2026-54714 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in Logto, an open-source authentication infrastructure for SaaS and AI applications. Versions of @logto/core prior to 1.41.0 reflect the SAML RelayState, SAMLResponse, and actionUrl parameters into a Logto-origin auto-submit HTML form without HTML-attribute escaping. The vulnerable code resides in packages/core/src/saml-application/SamlApplication/utils.ts. An attacker can craft a malicious RelayState value delivered through GET or POST /api/saml/:id/authn to inject script that executes on the Logto tenant origin after login.

Critical Impact
Attackers can execute arbitrary JavaScript in the Logto tenant origin, enabling session token theft, account takeover, and abuse of authenticated user sessions during SAML flows.

Affected Products

Logto @logto/core versions prior to 1.41.0
SAML application authentication endpoints (/api/saml/:id/authn)
Logto tenants that expose SAML application flows

Discovery Timeline

2026-07-10 - CVE-2026-54714 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-54714

Vulnerability Analysis

The vulnerability exists in the generateAutoSubmitForm function in packages/core/src/saml-application/SamlApplication/utils.ts. Logto uses this function to build an auto-submitting HTML form that forwards a SAML response to a Service Provider's Assertion Consumer Service (ACS) URL. The function embeds three attacker-influenceable values into HTML attributes: the form's action URL, the SAMLResponse, and the RelayState. Prior to version 1.41.0, none of these values were escaped for HTML-attribute context before insertion. Because the form is served from the Logto tenant origin, injected JavaScript executes with access to that origin's cookies and storage.

Root Cause

The root cause is missing output encoding when reflecting user-controlled input into HTML attributes. The affected code inserted raw string values into value="…" and action="…" attributes. A crafted RelayState containing a double quote followed by an event handler such as " onfocus=… breaks out of the attribute and injects arbitrary markup. The vulnerability is a classic reflected XSS pattern rooted in improper neutralization of input during web page generation.

Attack Vector

Exploitation requires user interaction. An attacker crafts a link to GET /api/saml/:id/authn with a malicious RelayState parameter and lures a victim to complete the SAML login flow. After authentication, Logto generates the auto-submit form with the unescaped payload, and the browser executes the injected script under the Logto tenant origin. The attack scope is Changed, because injected script runs in a security context different from the attacker's original SAML application context.

typescript

// Source: https://github.com/logto-io/logto/commit/209fa0a5cbe8522f9cf31873239dc6424099bb5e
// Fix in packages/core/src/saml-application/SamlApplication/utils.ts

const escapeHtmlAttributeValue = (value: string): string =>
  value
    .replaceAll('&', '&')
    .replaceAll('"', '"')
    .replaceAll("'", ''')
    .replaceAll('<', '<')
    .replaceAll('>', '>');

const safeActionUrlProtocols = Object.freeze(['http:', 'https:']);

// HTML-escaping the action attribute prevents markup breakouts but not scriptable schemes
// (e.g. `javascript:`), which the browser would execute on form submission.
const isSafeActionUrl = (actionUrl: string): boolean => {
  try {
    return safeActionUrlProtocols.includes(new URL(actionUrl).protocol);
  } catch {
    return false;
  }
};

export const generateAutoSubmitForm = (
  actionUrl: string,
  samlResponse: string,
  relayState?: string
): string => {
  assertThat(isSafeActionUrl(actionUrl), 'application.saml.acs_url_scheme_not_supported', 400);
  // ... attribute values now escaped before insertion
};

The patch introduces escapeHtmlAttributeValue and enforces that actionUrl uses only http: or https: schemes to block javascript: URIs. See the GitHub Security Advisory GHSA-cpm5-w86q-w85f for full disclosure details.

Detection Methods for CVE-2026-54714

Indicators of Compromise

Requests to /api/saml/:id/authn containing HTML metacharacters such as ", <, >, or ' inside the RelayState parameter.
Requests where RelayState contains strings resembling event handlers (onerror=, onload=, onfocus=) or javascript: URIs.
Anomalously long RelayState or SAMLResponse parameters compared to legitimate SAML SP traffic.
Outbound requests from browsers to attacker-controlled hosts immediately following a SAML login on the Logto tenant origin.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SAML endpoint parameters containing HTML-attribute breakout characters.
Enable Content Security Policy (CSP) reporting on the Logto tenant origin to capture inline script violations that indicate reflected XSS attempts.
Review Logto and reverse-proxy access logs for RelayState values that fail URL-decoding to a valid opaque token.

Monitoring Recommendations

Alert on SAML authentication requests where referrer headers point to untrusted external domains.
Monitor for spikes in /api/saml/:id/authn traffic tied to a small set of user accounts, which may indicate targeted phishing.
Correlate SAML login events with subsequent session activity from unusual geolocations or user agents.

How to Mitigate CVE-2026-54714

Immediate Actions Required

Upgrade @logto/core to version 1.41.0 or later on all Logto deployments.
Audit SAML application configurations and rotate any secrets or session tokens that may have been exposed to injected script during the vulnerable window.
Force re-authentication for users who completed SAML flows since the vulnerable version was deployed.

Patch Information

The fix is available in Logto v1.41.0, delivered via Pull Request #9008 and commit 209fa0a. The patch adds escapeHtmlAttributeValue to encode HTML-attribute values and restricts the actionUrl scheme to http: and https: to block scriptable URI schemes.

Workarounds

If immediate upgrade is not possible, disable SAML application flows on affected Logto tenants until the patch can be applied.
Enforce a strict Content Security Policy on the Logto tenant origin that prohibits inline scripts and restricts script-src to trusted origins.
Apply reverse-proxy rules that reject /api/saml/:id/authn requests with RelayState values containing <, >, ", or javascript:.

bash

# Upgrade Logto to the patched release
npm install @logto/core@1.41.0

# Or pull the patched Docker image
docker pull svhd/logto:1.41.0

# Verify the installed version
npm ls @logto/core