🚨 HIGH - Logto SAML IdP signed-attribute XML injection (CVE-2026-55789) Prior to 1.41.0, Logto’s self-hosted SAML application IdP (via its SAML response construction path, including samlify usage) built signed SAML responses by string-substituting user-controlled profile attributes into an XML template without escaping. The root cause is improper input validation/output encoding leading to XML injection in a signed assertion context. An authenticated low-privilege user can set a crafted profile attribute containing XML markup, causing Logto to generate and cryptographically sign forged SAML attributes (e.g., roles/groups) that are then consumed by a relying service provider. Impact is privilege escalation at downstream service providers that trust SAML attributes, potentially granting unauthorized admin access and broad account takeover within those apps. 👉 Affected: logto self-hosted SAML app IdP < 1.41.0 (samlify in the SAML response construction chain) | Upgrade to 1.41.0
Post summary
Logto’s self‑hosted SAML IdP (before v1.41.0) suffers XML injection in signed SAML responses that can enable privilege escalation at downstream providers. The vulnerability is mitigated by upgrading to version 1.41.0.