CVE-2026-15614

The Logto identity and access management system is vulnerable to an authentication bypass via session replay because it fails to atomically handle IdP-initiated SAML sessions . The root cause is that session lookup and session deletion are separate steps; because the lookup response is returned b...