CVE-2026-55370Medium· 6.4▾ SunlitLogto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window bec…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window = 1 and did not persist or compare the accepted TOTP time-step counter. An attacker who has the victim's first factor and captures a live TOTP value can replay that value to satisfy MFA during the same acceptance window. This issue is fixed in version 1.41.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-37982Medium· 6.8Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay
CVE-2026-104381Medium· 6.0Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
CVE-2026-41020High· 7.5Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
CVE-2026-117470Medium· 6.5WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-116825Medium· 6.5YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
CVE-2026-89209Medium· 6.8A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29)