CVE-2026-54714 Logto: XSS via unescaped RelayState in SAML auto-submit form
Attackers can inject scripts via unescaped SAML RelayState parameters, executing code on the Logto tenant origin after user login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-54714?
CVE-2026-54714 is a medium-severity cross-site scripting vulnerability in logto-io logto, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute escaping. A SAML application flow with a crafted RelayState from GET or POST /api/saml/:id/authn could inject script that runs on the Logto tenant origin after the user completes login. This issue is fixed in version 1.41.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-54714?
How do I fix CVE-2026-54714?
No fix has been published for CVE-2026-54714 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-54714 being exploited?
There is no known exploitation of CVE-2026-54714 in the wild and no public exploit code.
Sources
Also known as GHSA-cpm5-w86q-w85f.