CVE-2026-15617 Principal/domain lookup without case normalization

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...

CVE-2026-15617

The Logto identity and access management platform performs principal lookups using strict, unnormalized comparisons on identity attributes, including email domains , issuer identifiers , and identity IDs . Due to a lack of case, whitespace, and Unicode normalization , the system may fail to enfor...