Logto Unverified Email SSO Account Linking Vulnerability

Executive Summary

CVE-2026-15611 is a vulnerability in Logto's authentication system where unverified email-based SSO account linking allows an attacker to register an identity at a permissive Identity Provider (IdP) using a victim's email address. This grants unauthorized access to the victim's account without proper verification.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Logto's SSO verification logs for failed or inconsistent SAML connector sessions. Check for mismatches between jti session data and interaction storage in enterprise-sso-verification.ts. Monitor for unauthorized access attempts where unverified email-based SSO accounts are linked.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to your account by registering an SSO identity linked to your email at a permissive IdP. This bypasses proper authentication checks and could lead to data breaches or account takeover.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts, potentially violating data protection principles under GDPR and HIPAA. Unauthorized access risks exposure of personal data, which may result in non-compliance with confidentiality and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update Logto to the latest version to address the SAML connector session management flaw. Review and restrict SSO account linking policies to require email verification before linking accounts. Monitor authentication logs for unusual SSO session activity or failed verification attempts.

Useful 0 Not Useful 0