Lago versions up to 1.55.0 contain an authentication bypass that allows organization administrators to obtain JSON Web Tokens for any existing account by using the acceptInvite GraphQL mutation without providing a password. This flaw, classified as CWE-288, effectively removes the password check that should protect the invitation acceptance process. The attacker can invite a victim’s email, execute the mutation with an arbitrary password, and receive a JWT that grants full access to the victim’s organization, billing information, API keys, and payment integrations.

The vulnerability affects the GetLago Lago application, specifically all releases through 1.55.0. Administrators of any Lago organization can exploit this issue once they have permission to use the GraphQL API. No specific version beyond 1.55.0 is listed as affected, implying that later releases contain the fix.

The impact is high, reflected in a CVSS score of 8.7. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. The attack requires an attacker to be able to invoke the acceptInvite mutation, which typically implies that they have some level of organizational administration or have managed to inject an invitation. Once that prerequisite is met, the flaw allows invariant bypass of password authentication, leading to complete compromise of the victim’s organization and associated resources.