PT-2026-64017

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id token, enabling replay of authentication tokens and weakening session-binding...