Vulnerability in Logto

CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Affected products

  • Logto — versions 1.21.0

References