What happened
Logto (open-source auth infrastructure for SaaS and AI apps) versions 1.31.0-1.42.0: Account API handlers allowing a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise third-party tokens, exposing linked-account credentials beyond the granted scope. Fixed in 1.43.0.
Why it matters
Logto is positioned as the auth layer for AI apps and agents; stored third-party (social/enterprise) tokens are exactly what agentic integrations rely on. An openid-only token disclosing them is a scope-escalation that can leak the credentials AI apps use to act on users' behalf.
Attack vector
Caller with a same-user openid-only access token accesses Account API third-party-token handlers to read stored social/enterprise OAuth tokens.
Affected systems
Logto 1.31.0-1.42.0 (fixed in 1.43.0)
Mitigation
Upgrade to Logto 1.43.0+; rotate exposed third-party tokens.