Unrated severityNVD Advisory· Published Jul 23, 2026· Updated Jul 27, 2026
SAML <Conditions> element not validated
CVE-2026-15615
Description
Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.