Skip to main content

CISA issues update on Logto authentication and SSO failures

Source Decision Insights Threat Desk Published August 23, 2026 Companies 1
Human View Machine View

50th article in the last 90 days, one of 593 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues Pegatron tdeio64.sys IOCTL privilege escalation update (Aug 2026).

Companies mentioned

Best suited for

Seniority
Director
Job function
Cybersecurity / Information Security
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Post Buy
Adoption curve
Early Adopters
Technology maturity
Market Correction
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

The Logto identity-processing pipeline has multiple authentication and SSO-related vulnerabilities that can reduce the reliability of authentication and authorization decisions. The issues may enable bypasses of account-ownership checks and MFA, replay externally issued SSO responses, and allow identity assertions to be processed without proper cryptographic or validity checks.

Developed by Silverhand Inc., Logto supports multi-tenant authentication, single sign-on (SSO), role-based access control (RBAC), openId connect (OIDC), open authorization (OAuth) 2.1, and Security Assertion Markup Language (SAML) authentication. CVE-2026-15611 allows unverified email-based SSO account linking when a new SSO login arrives and no existing (issuer, identityId) account is found; Logto searches local users by the email address supplied by the IdP and links the SSO identity to that account without requiring the IdP to confirm email_verified. CVE-2026-15612 stores a nonce in the connector session and expects the returned id_token to echo it back, but the validation is guarded by if (data.nonce), so omission of the nonce claim in the id_token skips the check even when nonceFromSession is set. CVE-2026-15614 does not atomically handle IdP-initiated SAML sessions, allowing two near-simultaneous requests using the same session identifier to pass lookup before deletion completes, so the same IdP-initiated assertion authorizes two separate sign-ins. CVE-2026-15615 relies on the samlify library to validate the SAML Conditions element, but the samlify check is bypassed when Conditions is absent, which bypasses the NotBefore and NotOnOrAfter time window check and includes no independent validation by Logto. CVE-2026-15616 bypasses locally configured MFA during SSO when hasVerifiedSsoIdentity is true. CVE-2026-15617 performs strict, unnormalized comparisons on identity attributes (email domains, issuer identifiers, and identity IDs), and the absence of case, whitespace, and Unicode normalization leads to inconsistent domain-rule enforcement and incorrect resolution of linked identities, binding sessions to unintended local accounts.

Taken together, the vulnerabilities fail to implement core identity protections across the OIDC, OAuth 2.1, and SAML protocols. The flaws can interact to evade account-ownership checks and MFA, replay federated sessions, and inject unvalidated or unsigned identity assertions.

Silverhand Inc. could not be reached for coordination of these vulnerabilities. Until a patch is available, administrators are advised to reduce attack surface by avoiding local accounts that share the same email addresses as federated sign-in accounts, because Logto does not expose a setting to disable automatic email-based account linking. The guidance also includes avoiding the “social SAML” connector entirely. It further states to require MFA at the upstream IdP for all federated sign-ins, enforce strict domain normalization at the IdP or provisioning layer, shorten session lifetimes and aggressively invalidate sessions, monitor authentication logs for anomalies, and place Logto behind an identity-aware reverse proxy.

Thanks to the reporting team, Zixu (Jason) Zhou (PhD student), Professor David Lie, Ilya Grishchenko (Postdoc), and Xiangyu Guo (PhD student) of the University of Toronto, with the vulnerability note prepared by Laurie Tyzenhaus.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-update-on-logto-authentication-and-sso-failures/",
        "name": "CISA issues update on Logto authentication and SSO failures",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-update-on-logto-authentication-and-sso-failures/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Adopters"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Market Correction"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:56:14-06:00",
    "datePublished": "2026-08-23T09:44:26-06:00",
    "description": "Logto authentication vulnerabilities enable bypasses of MFA and account linking, allow SSO replay, and skip SAML time-window checks in CISA-referenced advisories.",
    "headline": "CISA issues update on Logto authentication and SSO failures",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/492466"
    },
    "keywords": [
      "Authentication",
      "Authorization",
      "Normalization",
      "OpenID Connect",
      "Single Sign-On",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-update-on-logto-authentication-and-sso-failures/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/projects/oauth/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/oauth/",
        "name": "OAuth"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages