CVE-2026-15614 Logto CVE debrief

Who should care

Users of Logto who rely on SAML sessions for authentication and authorization should be aware of this vulnerability and take necessary precautions. Affected operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and implement necessary mitigations.

Technical summary

The vulnerability exists in Logto's handling of IdP-initiated SAML sessions. When a session is initiated, Logto fails to properly delete the session, allowing for session replay and reuse within the session's validity window. This can be exploited by an attacker to gain unauthorized access to sensitive information. The affected product context is Logto deployments relying on SAML sessions for authentication and authorization.

Defensive priority

High

Recommended defensive actions

• Review and update Logto configurations to ensure proper session management
• Implement additional monitoring and logging to detect potential session reuse
• Consider implementing compensating controls, such as IP blocking or user agent verification
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-23T16:17:14.143Z and has been modified since then. The NVD entry is currently Deferred. The Logto vulnerability allows session replay and reuse due to silent failure in deleting IdP-initiated SAML sessions. Evidence is limited, and defenders should verify affected scope and vendor guidance.

Official resources