Affected Logto installations exposed stored social or enterprise SSO provider access tokens through two GET endpoints. A caller with a same‑user access token that only requested the openid scope could query /api/my-account/identities/{target}/access-token or /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticated the user but did not enforce the identities scope that is normally required for identity‑detail operations, creating a scope‑bypass that allows unintended disclosure of provider tokens.

The vulnerability exists in Logto versions 1.31.0 through 1.42.0 inclusive. The product is the Logto open‑source authentication platform used for SaaS and AI applications. If federated token‑set storage is enabled and a user authenticates through a supported third‑party connector, the compromised endpoints will return the provider’s access token for that user.

The CVSS score of 7.6 indicates a high impact. An attacker must possess a valid same‑user token for the victim and the target application must have enabled federated token storage. Once the provider token is retrieved, a malicious application with a low‑trust profile can use it against upstream APIs within the token’s scope, potentially impersonating the user or accessing protected resources. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the design flaw is a missing authorization control (CWE‑862). Exploitation requires API access but no elevated privileges beyond a legitimate user token.