Lago (<= 1.55.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/lago--1.55.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 13:29:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLago: Authentication bypass in acceptInvite mutation (CVE-2026-119420)https://feed.craftedsignal.io/briefs/2026-10-lago-auth-bypass/Fri, 30 Oct 2026 13:29:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lago-auth-bypass/Lago versions through 1.55.0 contain an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check.<p>Lago versions through 1.55.0 are vulnerable to an authentication bypass via the acceptInvite mutation. An attacker can invite a victim's email, accept the invitation with an arbitrary password, and receive a JWT. This enables access to the victim's organizations, billing data, API keys, and payment integrations.</p> highadvisory