CVE-2026-15615 — Vulnetix

CVE-2026-15615 PUBLISHED CVSS 7.5 HIGH

Reported by certcc · Published July 23, 2026

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Logto	Logto	1.12.0
Logto	Logto	1.12.0, 1.12.0

Timeline

Jul 23, 2026 CVE Published
Jul 24, 2026 Coalition ESS Score
Jul 24, 2026 Security Advisory
Jul 25, 2026 EPSS Score

References

Open in Interactive Console →