CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15615

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15617

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...

CVE-2026-15616

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-15611

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...

CVE-2026-15611

CVE-2026-15611 affects Logto Identity Platform. An unverified email-based SSO account linking flaw allows an attacker to register the victim’s email at a permissive upstream IdP and link it to the victim’s local account on first login, enabling unauthorized access. Root cause per sources: Logto d...

EUVD-2026-48304

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612

CVE-2026-15612 affects Logto Identity Platform. The vulnerability arises when the OIDC nonce validation is skipped if the id_token omits the nonce claim, because the validation path checks if data.nonce. As a result, a missing nonce can allow replay of authentication tokens and weaken session-bin...

CVE-2026-15612 LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612 LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

EUVD-2026-48303

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614

CVE-2026-15614 affects Logto: IdP-initiated SAML sessions are not handled atomically, as session lookup may complete before deletion. This can allow the same session identifier to pass validation twice, enabling replay/dual sign-ins within the session’s window. The description and connected refer...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

EUVD-2026-48301

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-15616

Logto has a CVE-2026-15616 issue where the authentication flow does not enforce locally configured MFA during SSO. The root cause is that MFA can be bypassed when hasVerifiedSsoIdentity is true, enabling an attacker with a federated identity from a permissive upstream IdP to sign in via SSO and b...

CVE-2026-15617 Principal/domain lookup without case normalization

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...

CVE-2026-15617

CVE-2026-15617 affects Logto Identity Platform: during SSO, the system performs strict, unnormalized comparisons of identity attributes (email, issuer, identity IDs), allowing sessions to bind to unintended local accounts due to case/whitespace/Unicode differences. This can enable unauthorized ac...

PT-2026-64019

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to validate the SAML element. This allows attackers to remove time and audience restrictions, which enables the indefinite replay of assertions. SAML Security Assertion Markup...