PT-2026-64016 · Logto · Logto

CVE-2026-15611 · Published 2026-07-23 · Updated 2026-07-23

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Logto (affected versions not specified)

Description Logto allows unverified email-based SSO account linking. When a new SSO login occurs for an unknown (issuer, identityId) pair, the system searches for a local user by the email provided by the Identity Provider (IdP) and links the SSO identity to that account without requiring the IdP to confirm the email verified status. This flaw enables an attacker to register an identity at a permissive IdP using a victim's email to gain unauthorized access to the victim's account. Additionally, other issues in the identity-processing pipeline allow for MFA bypass, SSO replay, and the acceptance of identity assertions without proper cryptographic or validity checks.

Recommendations Apply vendor-supplied patches. Review identity provider configurations to ensure robust email verification and assertion validation.

Related Identifiers

CVE-2026-15611

Affected Products

Logto

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-15611 · Security Note
• https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L274 · Note
• https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/verifications/enterprise-sso-verification.ts#L284-L297 · Note
• https://reddit.com/r/SecOpsDaily/comments/1v4i764/vu492466_logto_identity_platform_has · Reddit Post