CVE-2026-15612 Logto CVE debrief

Who should care

Users of Logto should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating their Logto configurations to ensure proper OIDC nonce validation, checking for any existing authentication tokens that may have been issued before the fix, and revoking them if necessary. Security teams and operators should also review compensating controls and monitor for potential exploitation.

Technical summary

The vulnerability is caused by a lack of proper validation of the nonce claim in the id_token. This allows an attacker to replay authentication tokens, potentially leading to unauthorized access. The vulnerability has been assigned a CVSS score of 9.1, indicating a high level of severity. Technical details are limited, but defenders should focus on ensuring proper OIDC nonce validation and reviewing authentication token issuance and session-binding mechanisms.

Defensive priority

High

Recommended defensive actions

• Review and update Logto configurations to ensure proper OIDC nonce validation
• Implement additional security measures to prevent replay of authentication tokens
• Monitor for potential exploitation of this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record was published on 2026-07-23T16:17:14.047Z and has been modified since then. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify Logto configurations and OIDC nonce validation. Additional review of authentication tokens and session-binding mechanisms is recommended.

Official resources