Logto vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Logto products: 6 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-15617 Critical · 9.1 CWE-178 Jul 23, 2026

Principal/domain lookup without case normalization

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

CVE-2026-15616 Critical · 9.1 CWE-308 Jul 23, 2026

Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

CVE-2026-15615 High · 7.5 CWE-345 Jul 23, 2026

SAML <Conditions> element not validated

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

CVE-2026-15614 High · 7.5 CWE-294 Jul 23, 2026

IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

CVE-2026-15612 Critical · 9.1 CWE-345 Jul 23, 2026

LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

CVE-2026-15611 Critical · 9.1 CWE-287 Jul 23, 2026

Unverified email-based SSO account linking

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.