CVE-2026-15614 | CyberRota

CyberRota Analysis

AI-Generated

Logto is vulnerable due to its failure to properly delete IdP-initiated SAML sessions, which allows attackers to exploit session replay and reuse within the session's validity period. This could lead to unauthorized access and potential data breaches. Organizations utilizing Logto for identity management should prioritize addressing this vulnerability to safeguard their authentication processes.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-15614

Severity

HIGH

CVSS

7.5

EPSS

0.23%

Original NVD Description

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.