CVE-2026-15615

Vulnerability Description

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

Vulnerability Details

Published Date

July 23, 2026

Last Modified

July 23, 2026

Source

NVD

Vendor

Logto

Product

Logto

External References

https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/connectors/connector-saml/src/utils.ts#L46-L110
https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/SamlConnector/utils.ts#L175-L205

CVE-2026-15615

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment