A regular expression used for email subaddressing in Logto’s authentication flow was permissively constructed from raw user input. The regex allowed multiple at signs and metacharacters, enabling an attacker to supply a specially crafted email address that triggers catastrophic backtracking. This causes the Node.js event loop to stall, effectively dropping authentication, token issuance, single‑sign‑on, and administrative console services until the process recovers.

The vulnerability exists in logto-io Logto versions earlier than 1.41.0. Systems running any of these pre‑1.41.0 releases are vulnerable; the fix is delivered in release 1.41.0.

The CVSS score of 7.5 marks it as a high‑severity issue, and the EPSS score is not available, though the lack of a KEV listing does not negate its relevance. Attackers can exploit the flaw by sending a malicious payload to POST /api/experience/verification/verification-code, a remote HTTP endpoint that accepts the email address as unvalidated input.