Logto’s TOTP verification logic permitted a submitted one‑time password to be reused within the RFC 6238 window because the verifier used a stateless check that did not record the accepted counter. An attacker who had obtained the victim’s primary factor or access to the user’s device could capture a live TOTP value and replay it during the same window to satisfy multi‑factor authentication. This flaw allows an authenticated user whose first factor is compromised to bypass MFA and impersonate the victim’s account.

All deployments of logto‑io:logto older than version 1.41.0 are vulnerable. Versions 1.41.0 and later remove the stateless behavior, persist the accepted counter, and enforce single‑use validation.

The CVSS score of 6.4 indicates moderate to high severity. The EPSS score of less than 1 % suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, capturing a live TOTP value requires the attacker to have the victim’s primary factor or to compromise the user’s device; once obtained, the code can be replayed during the same validity window. Accounts with enabled TOTP MFA that have not applied the fix remain vulnerable.