CVE-2026-119420
highLago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via…
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://abraxaslabs.tech/research/lago-invite-ato disclosure@vulncheck.com
- https://github.com/getlago/lago-api disclosure@vulncheck.com
- https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L1... disclosure@vulncheck.com
- https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98 disclosure@vulncheck.com
- https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305 disclosure@vulncheck.com
- https://github.com/getlago/lago-api/pull/6146 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-accepti... disclosure@vulncheck.com