PatchSiren cyber security CVE debrief

CVE-2026-15612 Logto CVE debrief

CVE-2026-15612 is a critical vulnerability in Logto that bypasses OIDC nonce validation when the nonce claim is absent from the id_token. This allows for replay of authentication tokens and weakens session-binding. The vulnerability has a CVSS score of 9.1 and is considered critical. Affected users should review and update their Logto configurations to ensure proper OIDC nonce validation. This includes checking for any existing authentication tokens that may have been issued before the fix and revoking them if necessary.

Vendor: Logto
Product: Unknown
CVSS: CRITICAL 9.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-23
Original CVE updated: 2026-07-27
Advisory published: 2026-07-23
Advisory updated: 2026-07-27

Who should care

Users of Logto should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating their Logto configurations to ensure proper OIDC nonce validation, checking for any existing authentication tokens that may have been issued before the fix, and revoking them if necessary. Security teams and operators should also review compensating controls and monitor for potential exploitation.

Technical summary

The vulnerability is caused by a lack of proper validation of the nonce claim in the id_token. This allows an attacker to replay authentication tokens, potentially leading to unauthorized access. The vulnerability has been assigned a CVSS score of 9.1, indicating a high level of severity. Technical details are limited, but defenders should focus on ensuring proper OIDC nonce validation and reviewing authentication token issuance and session-binding mechanisms.

Defensive priority

High

Recommended defensive actions

Review and update Logto configurations to ensure proper OIDC nonce validation
Implement additional security measures to prevent replay of authentication tokens
Monitor for potential exploitation of this vulnerability
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record was published on 2026-07-23T16:17:14.047Z and has been modified since then. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify Logto configurations and OIDC nonce validation. Additional review of authentication tokens and session-binding mechanisms is recommended.

Sources and references

Verified primary and authoritative sources

CVE-2026-15612 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-15612

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-15612 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-15612

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/sso/OidcConnector/utils.ts

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.