CVE-2026-15612

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612

CVE-2026-15612 affects Logto’s OIDC implementation: when the nonce claim is absent from the id_token, nonce validation can be bypassed, enabling replay of authentication tokens and weakening session-binding. The related code appears in Logto core (sso/OidcConnector/utils.ts, lines ~175–182). No r...

EUVD-2026-48304

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...