Live › vulnerability › CVE-2026-119420
Lago, an open-source billing platform, lets an organization administrator invite an existing user's email and then accept the invite with an arbitrary password through the acceptInvite mutation, with no password check. The attacker receives a JWT for the victim's account, giving access to the victim's organizations, billing data, API keys and payment integrations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted or managed deployments of Lago through version 1.55.0 are exposed to any organization administrator who can send invites. The sources do not say whether a non-admin user or an unauthenticated attacker can reach the same path. Teams that do not run Lago can skip this.
No product ranges from the sources yet.
unknown version command in the sources1.55.0, the last version the sources list as affected1.55.0: the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
This page as .md · .json · in your agent: get_signal("CVE-2026-119420")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.