Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Weakness
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/16.html
- https://cwe.mitre.org/data/definitions/49.html
- https://cwe.mitre.org/data/definitions/509.html
- https://cwe.mitre.org/data/definitions/55.html
- https://cwe.mitre.org/data/definitions/555.html
- https://cwe.mitre.org/data/definitions/560.html
- https://cwe.mitre.org/data/definitions/561.html
- https://cwe.mitre.org/data/definitions/565.html
- https://cwe.mitre.org/data/definitions/600.html
- https://cwe.mitre.org/data/definitions/644.html
- https://cwe.mitre.org/data/definitions/645.html
- https://cwe.mitre.org/data/definitions/652.html
- https://cwe.mitre.org/data/definitions/653.html
- https://cwe.mitre.org/data/definitions/70.html