Back to CVE List

CVE-2026-15614

Vulnerability Description

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Vulnerability Details

Published Date

July 23, 2026

Last Modified

July 23, 2026

Source

NVD

Vendor

Logto

Product

Logto

External References

https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L81-L99

Discussion (0)

Add Comment

No comments yet. Be the first!