CVE-2026-15617 Principal/domain lookup without case normalization

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...

CVE-2026-15617

Logto is affected by CVE-2026-15617 due to a lack of normalization in principal lookups, allowing collisions between identities that differ only in case or Unicode form. Specifically, the issue arises in the verification path (verification-helpers/single-sign-on-guard.ts) used during authenticati...