CVE-2026-15612
Deferred Deferred - Pending Action

Logto OIDC Nonce Validation Bypass Vulnerability

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: CERT/CC

Description
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-15612
EUVD
EUVD-2026-48304

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
logto logto *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Logto allows attackers to bypass OIDC nonce validation when the nonce claim is missing from the id_token. This enables replay attacks where authentication tokens can be reused, weakening session security and allowing unauthorized access.

Detection Guidance

To detect this vulnerability, monitor Logto instances for OIDC authentication flows where the nonce claim is missing in id_tokens. Check logs for replayed tokens or session-binding failures. Use network traffic analysis tools like Wireshark or tcpdump to inspect OIDC token exchanges for missing nonce values.

Impact Analysis

Attackers could exploit this to replay stolen or intercepted authentication tokens, gaining unauthorized access to user accounts or sensitive data. This could lead to data breaches, account takeovers, or unauthorized actions performed on behalf of legitimate users.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection principles in GDPR and compromising protected health information under HIPAA. Organizations may face compliance failures, legal penalties, and reputational damage due to insufficient session security.

Mitigation Strategies

Update Logto to the latest version to ensure OIDC nonce validation is properly enforced. Review authentication logs for unusual token reuse or replay attempts. Disable affected SSO integrations temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart