CVE-2026-15614

CVE-2026-15614 affects Logto where IdP-initiated SAML sessions are not deleted, enabling session replay within the session validity window. The issue is tied to the core verification logic (see logto core verification-helpers single-sign-on.ts) and results in the reuse of an active IdP-initiated ...