Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    12 vulnerabilities by Logto

    CVE-2026-15617 (GCVE-0-2026-15617)

    Vulnerability from nvd – Published: 2026-07-23 15:41 – Updated: 2026-07-23 15:41
    VLAI
    Title
    Principal/domain lookup without case normalization
    Summary
    Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.10.1 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.10.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-178 Improper Handling of Case Sensitivity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:41:29.123Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on-guard.ts#L23-L33"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Principal/domain lookup without case normalization",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15617"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15617",
    "datePublished": "2026-07-23T15:41:29.123Z",
    "dateReserved": "2026-07-13T16:14:46.769Z",
    "dateUpdated": "2026-07-23T15:41:29.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15616 (GCVE-0-2026-15616)

    Vulnerability from nvd – Published: 2026-07-23 15:43 – Updated: 2026-07-23 15:43
    VLAI
    Title
    Local MFA not enforced during SSO sign-in
    Summary
    Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.19.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.19.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-308 Use of Single-factor Authentication",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:43:03.647Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/experience-interaction.ts#L538-L540"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local MFA not enforced during SSO sign-in",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15616"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15616",
    "datePublished": "2026-07-23T15:43:03.647Z",
    "dateReserved": "2026-07-13T16:14:31.396Z",
    "dateUpdated": "2026-07-23T15:43:03.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15615 (GCVE-0-2026-15615)

    Vulnerability from nvd – Published: 2026-07-23 15:43 – Updated: 2026-07-23 15:43
    VLAI
    Title
    SAML <Conditions> element not validated
    Summary
    Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.12.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto omits validation of the SAML \u003cConditions\u003e element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:43:42.802Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/SamlConnector/utils.ts#L175-L205"
        },
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/connectors/connector-saml/src/utils.ts#L46-L110"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SAML \u003cConditions\u003e element not validated",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15615"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15615",
    "datePublished": "2026-07-23T15:43:42.802Z",
    "dateReserved": "2026-07-13T16:14:15.128Z",
    "dateUpdated": "2026-07-23T15:43:42.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15614 (GCVE-0-2026-15614)

    Vulnerability from nvd – Published: 2026-07-23 15:44 – Updated: 2026-07-23 15:44
    VLAI
    Title
    IdP-initiated SAML sessions not reliably invalidated (replay)
    Summary
    Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.21.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.21.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session\u2019s validity window."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-294 Authentication Bypass by Capture-replay",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:44:53.742Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L81-L99"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IdP-initiated SAML sessions not reliably invalidated (replay)",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15614"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15614",
    "datePublished": "2026-07-23T15:44:11.159Z",
    "dateReserved": "2026-07-13T16:13:59.834Z",
    "dateUpdated": "2026-07-23T15:44:53.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15612 (GCVE-0-2026-15612)

    Vulnerability from nvd – Published: 2026-07-23 15:45 – Updated: 2026-07-23 15:45
    VLAI
    Title
    LOIDC nonce validation bypass
    Summary
    Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.10.1 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.10.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:45:27.100Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/OidcConnector/utils.ts#L175-L182"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LOIDC nonce validation bypass",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15612"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15612",
    "datePublished": "2026-07-23T15:45:27.100Z",
    "dateReserved": "2026-07-13T16:12:30.539Z",
    "dateUpdated": "2026-07-23T15:45:27.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15611 (GCVE-0-2026-15611)

    Vulnerability from nvd – Published: 2026-07-23 15:45 – Updated: 2026-07-23 15:45
    VLAI
    Title
    Unverified email-based SSO account linking
    Summary
    Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.11.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim\u2019s email and gain unauthorized access to the victim\u2019s account."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-287 Improper Authentication",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:45:48.250Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L274"
        },
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/verifications/enterprise-sso-verification.ts#L284-L297"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unverified email-based SSO account linking",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15611"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15611",
    "datePublished": "2026-07-23T15:45:48.250Z",
    "dateReserved": "2026-07-13T16:09:08.015Z",
    "dateUpdated": "2026-07-23T15:45:48.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15611 (GCVE-0-2026-15611)

    Vulnerability from cvelistv5 – Published: 2026-07-23 15:45 – Updated: 2026-07-23 15:45
    VLAI
    Title
    Unverified email-based SSO account linking
    Summary
    Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.11.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim\u2019s email and gain unauthorized access to the victim\u2019s account."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-287 Improper Authentication",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:45:48.250Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L274"
        },
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/verifications/enterprise-sso-verification.ts#L284-L297"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unverified email-based SSO account linking",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15611"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15611",
    "datePublished": "2026-07-23T15:45:48.250Z",
    "dateReserved": "2026-07-13T16:09:08.015Z",
    "dateUpdated": "2026-07-23T15:45:48.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15612 (GCVE-0-2026-15612)

    Vulnerability from cvelistv5 – Published: 2026-07-23 15:45 – Updated: 2026-07-23 15:45
    VLAI
    Title
    LOIDC nonce validation bypass
    Summary
    Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.10.1 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.10.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:45:27.100Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/OidcConnector/utils.ts#L175-L182"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LOIDC nonce validation bypass",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15612"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15612",
    "datePublished": "2026-07-23T15:45:27.100Z",
    "dateReserved": "2026-07-13T16:12:30.539Z",
    "dateUpdated": "2026-07-23T15:45:27.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15614 (GCVE-0-2026-15614)

    Vulnerability from cvelistv5 – Published: 2026-07-23 15:44 – Updated: 2026-07-23 15:44
    VLAI
    Title
    IdP-initiated SAML sessions not reliably invalidated (replay)
    Summary
    Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.21.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.21.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session\u2019s validity window."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-294 Authentication Bypass by Capture-replay",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:44:53.742Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L81-L99"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IdP-initiated SAML sessions not reliably invalidated (replay)",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15614"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15614",
    "datePublished": "2026-07-23T15:44:11.159Z",
    "dateReserved": "2026-07-13T16:13:59.834Z",
    "dateUpdated": "2026-07-23T15:44:53.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15615 (GCVE-0-2026-15615)

    Vulnerability from cvelistv5 – Published: 2026-07-23 15:43 – Updated: 2026-07-23 15:43
    VLAI
    Title
    SAML <Conditions> element not validated
    Summary
    Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.12.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto omits validation of the SAML \u003cConditions\u003e element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:43:42.802Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/SamlConnector/utils.ts#L175-L205"
        },
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/connectors/connector-saml/src/utils.ts#L46-L110"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SAML \u003cConditions\u003e element not validated",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15615"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15615",
    "datePublished": "2026-07-23T15:43:42.802Z",
    "dateReserved": "2026-07-13T16:14:15.128Z",
    "dateUpdated": "2026-07-23T15:43:42.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15616 (GCVE-0-2026-15616)

    Vulnerability from cvelistv5 – Published: 2026-07-23 15:43 – Updated: 2026-07-23 15:43
    VLAI
    Title
    Local MFA not enforced during SSO sign-in
    Summary
    Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.19.0 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.19.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-308 Use of Single-factor Authentication",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:43:03.647Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/experience-interaction.ts#L538-L540"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local MFA not enforced during SSO sign-in",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15616"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15616",
    "datePublished": "2026-07-23T15:43:03.647Z",
    "dateReserved": "2026-07-13T16:14:31.396Z",
    "dateUpdated": "2026-07-23T15:43:03.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-15617 (GCVE-0-2026-15617)

    Vulnerability from cvelistv5 – Published: 2026-07-23 15:41 – Updated: 2026-07-23 15:41
    VLAI
    Title
    Principal/domain lookup without case normalization
    Summary
    Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Logto Logto Affected: 1.10.1 , ≤ 1.37.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Logto",
          "vendor": "Logto",
          "versions": [
            {
              "lessThanOrEqual": "1.37.1",
              "status": "affected",
              "version": "1.10.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-178 Improper Handling of Case Sensitivity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T15:41:29.123Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on-guard.ts#L23-L33"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Principal/domain lookup without case normalization",
      "x_generator": {
        "engine": "VINCE 3.0.43",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15617"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-15617",
    "datePublished": "2026-07-23T15:41:29.123Z",
    "dateReserved": "2026-07-13T16:14:46.769Z",
    "dateUpdated": "2026-07-23T15:41:29.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}