CVE-2026-15611 Unverified email-based SSO account linking

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

EUVD-2026-48301

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

CVE-2026-15616

Logto has a CVE-2026-15616 issue where the authentication flow does not enforce locally configured MFA during SSO. The root cause is that MFA can be bypassed when hasVerifiedSsoIdentity is true, enabling an attacker with a federated identity from a permissive upstream IdP to sign in via SSO and b...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

GHSA-7RQJ-J65F-68WH Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the SignIn process in Google Chrome before version 150.0.7871.47 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Low...

Logto Identity Platform has authentication and authorization failures in core protocol handling

Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, ...

PT-2026-64020

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to enforce locally configured Multi-Factor Authentication MFA during Single Sign-On SSO authentication. This flaw allows users to bypass second-factor requirements, potentially...

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

GHSA-Q6CQ-MHR2-JMR5 Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

The HAProxyMessageDecoder in netty's codec-haproxy module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java byte and widening it to int without masking. When an attacker sends a PROXY protocol v2 binary prefix 0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A...

EUVD-2026-46438

Netty: codec-haproxy Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion...

GO-2026-6056 Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea...

SUSE CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

GHSA-MWQ7-VCMC-CM4Q Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-35q8-9mj6-wjmf. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016

CVE-2026-65016 affects n8n versions before 1.123.64, 2.29.8, and 2.30.1. The issue lies in Enterprise SSO instance-role provisioning: the IdP-asserted role claim is mapped to an n8n global role without preventing assignment of the global:owner role. Consequently, an SSO-authenticated user whose i...