CVE-2026-15614

Not yet scoredAwaiting CVSS assessment

Published

July 23, 2026

Affected

1 project

Assigned by

Description

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

GitHub🧑‍🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.

NVD