Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-15612
Not yet scoredAwaiting CVSS assessment
Description
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
logto-io/logto
GitHub🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
GitHub🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.NVD