CVE-2026-55370

creationtimestamp| type| source ---|---|--- 2026-07-11 01:53:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdkkikjuf26...

CVE-2026-55370 Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window ...