lago vulnerabilities

CVEs whose affected-version data names the lago package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119420High· 8.8

5d ago

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a vic…

▾ Twilightgetlago · lagoEPSS 0.39%via CVEORG