CVE-2026-15614
Deferred Deferred - Pending Action

Logto Session Replay via IdP-Initiated SAML Session Failure

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: CERT/CC

Description
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-15614
EUVD
EUVD-2026-48303

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
logto logto *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Logto fails to properly delete SAML sessions initiated by Identity Providers (IdP), allowing attackers to replay and reuse these sessions within the session's validity period.

Impact Analysis

Attackers could gain unauthorized access to user accounts by replaying stolen or intercepted SAML sessions, potentially leading to data breaches or privilege escalation.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA, resulting in non-compliance and potential legal penalties.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart