CVE-2026-15615

Description

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

Metadata

CVE ID: CVE-2026-15615
State: PUBLISHED
Assigner: certcc
Reserved: 2026-07-13 16:14 UTC
Published: 2026-07-23 15:43 UTC
Last updated: 2026-07-23 15:43 UTC
Vendor / Product: Logto / Logto
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Logto	Logto	—	1.12.0 ≤ 1.37.1

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-345 Insufficient Verification of Data Authenticity

References (2)

https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/SamlConnector/utils.ts#L175-L205
https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/connectors/connector-saml/src/utils.ts#L46-L110

Back to overview