Skip to main content

CISA issues update on Logto authentication and SSO failures

Decision Insights Threat Desk August 23, 2026

The Logto identity-processing pipeline has multiple authentication and SSO-related vulnerabilities that can reduce the reliability of authentication and authorization decisions. The issues may enable bypasses of account-ownership checks and MFA, replay externally issued SSO responses, and allow identity assertions to be processed without proper cryptographic or validity checks.

Developed by Silverhand Inc., Logto supports multi-tenant authentication, single sign-on (SSO), role-based access control (RBAC), openId connect (OIDC), open authorization (OAuth) 2.1, and Security Assertion Markup Language (SAML) authentication. CVE-2026-15611 allows unverified email-based SSO account linking when a new SSO login arrives and no existing (issuer, identityId) account is found; Logto searches local users by the email address supplied by the IdP and links the SSO identity to that account without requiring the IdP to confirm email_verified. CVE-2026-15612 stores a nonce in the connector session and expects the returned id_token to echo it back, but the validation is guarded by if (data.nonce), so omission of the nonce claim in the id_token skips the check even when nonceFromSession is set. CVE-2026-15614 does not atomically handle IdP-initiated SAML sessions, allowing two near-simultaneous requests using the same session identifier to pass lookup before deletion completes, so the same IdP-initiated assertion authorizes two separate sign-ins. CVE-2026-15615 relies on the samlify library to validate the SAML Conditions element, but the samlify check is bypassed when Conditions is absent, which bypasses the NotBefore and NotOnOrAfter time window check and includes no independent validation by Logto. CVE-2026-15616 bypasses locally configured MFA during SSO when hasVerifiedSsoIdentity is true. CVE-2026-15617 performs strict, unnormalized comparisons on identity attributes (email domains, issuer identifiers, and identity IDs), and the absence of case, whitespace, and Unicode normalization leads to inconsistent domain-rule enforcement and incorrect resolution of linked identities, binding sessions to unintended local accounts.

Taken together, the vulnerabilities fail to implement core identity protections across the OIDC, OAuth 2.1, and SAML protocols. The flaws can interact to evade account-ownership checks and MFA, replay federated sessions, and inject unvalidated or unsigned identity assertions.

Silverhand Inc. could not be reached for coordination of these vulnerabilities. Until a patch is available, administrators are advised to reduce attack surface by avoiding local accounts that share the same email addresses as federated sign-in accounts, because Logto does not expose a setting to disable automatic email-based account linking. The guidance also includes avoiding the “social SAML” connector entirely. It further states to require MFA at the upstream IdP for all federated sign-ins, enforce strict domain normalization at the IdP or provisioning layer, shorten session lifetimes and aggressively invalidate sessions, monitor authentication logs for anomalies, and place Logto behind an identity-aware reverse proxy.

Thanks to the reporting team, Zixu (Jason) Zhou (PhD student), Professor David Lie, Ilya Grishchenko (Postdoc), and Xiangyu Guo (PhD student) of the University of Toronto, with the vulnerability note prepared by Laurie Tyzenhaus.

Source: kb.cert.org.