CVE-2026-15611
Logto’s SSO account‑linking feature does not verify the email address of the identity provider. This allows an attacker to create a fake identity at a permissive IdP using a victim’s email and then link that identity to the victim’s Logto account, giving the attacker unauthorized access. The flaw is critical because it can compromise any user account without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The Logto identity and access management platform, specifically deployments that use its email‑based SSO account‑linking feature. Any user who relies on Logto for single sign‑on is potentially affected.
Real-world impact
An attacker can register a fake identity at a permissive IdP with the victim’s email, link it to the victim’s Logto account, and then access the victim’s account without needing a password.
Why this severity
The CVSS score of 9.1 reflects a network‑based attack that requires no user interaction or special privileges, yet grants the attacker full confidentiality and integrity compromise of the victim’s account. The low attack complexity and lack of required privileges make the vulnerability especially dangerous.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.