CERT/CC Warns of Six Logto Vulnerabilities in SSO and MFA Handling

TL;DR

CERT/CC published vulnerability note VU#492466 on 23 July 2026, covering six flaws in the Logto identity platform. The Logto vulnerabilities let attackers hijack accounts through unverified email linking, skip locally configured MFA, and replay SAML assertions. No patch exists yet, because CERT/CC could not reach the vendor.

Notable CVEs

Why it matters

Logto, built by Silverhand Inc., handles authentication for SaaS and AI applications. It supports multi-tenant sign-in, role-based access control, OIDC, OAuth 2.1, and SAML. When an identity layer misjudges who a user is, every downstream application inherits that mistake.

CERT/CC states the coordination problem bluntly: “Silverhand Inc. could not be reached for coordination of these vulnerabilities.” Vendor status for all six CVEs still reads Unknown, and no vendor statement has appeared.

How the attacks work

Each flaw targets a different stage of the identity pipeline.

Account takeover and MFA bypass

CVE-2026-15611 covers unverified email-based account linking. Logto matches a new SSO login to a local user by email address alone. It never requires the identity provider to confirm email_verified. An attacker who registers a victim’s email at a permissive upstream IdP can therefore claim that existing account on first login.

CVE-2026-15616 skips locally configured MFA during SSO sign-in. A verified federated identity satisfies the check on its own.

Token and assertion weaknesses

CVE-2026-15612 skips OIDC nonce validation when the id_token omits the claim entirely. Published CVE records frame the outcome as token replay and weakened session binding.

CVE-2026-15615 concerns SAML assertion timing. Omitting the Conditions element bypasses the NotBefore and NotOnOrAfter window, and Logto adds no independent check. CVE-2026-15614 lets one IdP-initiated SAML session authorize two separate sign-ins. Finally, CVE-2026-15617 covers unnormalized identity comparisons that bind sessions to unintended local accounts.

Affected versions

CERT/CC lists no affected or fixed version range. The advisory instead cites specific source files at one commit in the Logto GitHub repository. Administrators should treat current deployments as affected until Silverhand publishes guidance. No install count or user estimate has been published.

Exploitation status

Neither CERT/CC nor the CVE records confirm exploitation in the wild. No public proof-of-concept has been reported either. A research team from the University of Toronto reported the issues, and CERT/CC notified the vendor on 26 May 2026.

Mitigation steps

Until a fix arrives, CERT/CC recommends several defensive measures against these Logto vulnerabilities:

• Avoid local accounts that share email addresses used for federated sign-in
• Stop using Logto’s “social SAML” connector
• Require MFA at the upstream IdP for every federated login
• Enforce strict domain normalization at the IdP or provisioning layer
• Shorten session lifetimes and invalidate sessions aggressively
• Monitor authentication logs for anomalies
• Place Logto behind an identity-aware reverse proxy

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.