CVE-2026-15611

Logto suffers from unverified email-based SSO account linking, allowing an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account. Affected component: the email-based SSO/linking flow in Logto’s identity verification stack....