Logto SAML Assertion Replay via Missing Conditions Validation

Executive Summary

CVE-2026-15615 is a vulnerability in the Logto authentication platform where the SAML connector fails to properly validate the SAML Conditions element. This allows attackers to remove time and audience restrictions from SAML assertions, enabling indefinite replay of those assertions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect SAML responses for missing or improperly validated <Conditions> elements in the XML payload. Check Logto's SAML connector logs for malformed metadata or assertions. Use XML validation tools like xmllint to verify SAML assertion structure and time/audience restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to bypass authentication by replaying old SAML assertions indefinitely. It may lead to unauthorized access to systems, privilege escalation, or data leakage if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining authentication controls required by GDPR, HIPAA, and other regulations. It may lead to data breaches and non-compliance with security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update Logto to the latest patched version to address SAML assertion validation flaws. Review SAML connector configurations to ensure strict input validation is enforced. Monitor authentication logs for unusual SAML assertion patterns or unauthorized access attempts.

Useful 0 Not Useful 0