Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T20:17:19.890Z",
  "pubdate": "2026-08-19T20:17:19.890Z",
  "executiveSummary": "Logto prior to version 1.41.0 suffers from a regular expression denial of service (ReDoS) vulnerability caused by catastrophic backtracking within the email subaddressing blocklist validation logic.\nThe vulnerability allows an unauthenticated attacker to supply a specially crafted email payload via the API endpoint POST /api/experience/verification/verification-code, leading to excessive CPU resource consumption.\nThis resource exhaustion causes a complete stall of the Node.js event loop, rendering core platform capabilities unavailable, including authentication, token issuance, single sign-on (SSO), and the administrative console.\nExploitation requires the blockSubaddressing feature to be enabled and relies on the permissive email validation regex accepting multiple at-signs and regular expression metacharacters, which are then dynamically incorporated into the subaddressingRegex evaluation.\nThe risk is high due to the potential for complete denial of service across critical identity and access management workflows, impacting overall system availability.",
  "technicalDetails": "The vulnerability resides in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts of the Logto core package, specifically within the email subaddressing blocklist validation mechanism.\nThe root cause stems from the dynamic construction of the subaddressingRegex using attacker-controlled domain strings derived directly from incoming email input when the blockSubaddressing configuration is enabled.\nThe input validation relies on a permissive emailRegEx that fails to properly sanitize or restrict multiple at-signs and regular expression metacharacters.\nWhen a malicious payload containing crafted regex metacharacters is processed via the POST /api/experience/verification/verification-code endpoint, the resulting dynamic regular expression induces catastrophic backtracking during the execution of subaddressingRegex.test(email).\nBecause Node.js operates on a single-threaded event loop, the excessive computational cycles required to resolve the backtracking stall the entire event loop.\nThis event loop starvation halts all asynchronous operations and incoming requests, resulting in the unavailability of authentication services, token issuance, SSO integrations, and the administrative console.\nNo authentication or elevated privileges are required to trigger this endpoint, exposing the vulnerability over the network to any unauthenticated user capable of interacting with the verification code API.\nAffected versions include all Logto deployments prior to version 1.41.0 where email subaddressing blocklists are actively utilized."
}