Vulnerabilidades do Logto Logto
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Logto Logto: 5 registro(s), com versões afetadas e correções.
CVE-2026-15617
Crítica · 9.1
CWE-178 23/07/2026
Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
CVE-2026-15616
Crítica · 9.1
CWE-308 23/07/2026
Local MFA not enforced during SSO sign-in
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
CVE-2026-15615
Alta · 7.5
CWE-345 23/07/2026
SAML <Conditions> element not validated
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
CVE-2026-15614
Alta · 7.5
CWE-294 23/07/2026
IdP-initiated SAML sessions not reliably invalidated (replay)
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
CVE-2026-15612
Crítica · 9.1
CWE-345 23/07/2026
LOIDC nonce validation bypass
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.