CVE-2026-55789: XML Injection (aka Blind XPath Injection)

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into...

PT-2026-57292

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.41.0 Description The self-hosted SAML application IdP constructs signed SAML responses and assertions by substituting user-controlled profile attributes, such as name, email, and custom attribute-mapping values, into...

PT-2026-57279

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...

@quickguidehealth/connector-logto-novu (>=0.1.0, <=0.1.4) potentially affected by unknown CVE via @novu/api (3.11.0)

@novu/api NPM version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on @novu/api and may be impacted: - @quickguidehealth/connector-logto-novu =0.1.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-4X48-CGF9-Q33F...