CVE-2026-15617
Logto does not normalize email and identifier strings when performing principal lookups, which allows attackers to use case or Unicode variations to create colliding identities. This flaw can lead to unauthorized access to accounts and is rated critical with a CVSS base score of 9.1. No known exploitation or public exploit is reported, and the provided data does not list any affected products.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
No specific products are listed in the provided data.
Real-world impact
An attacker could gain unauthorized access to user accounts by exploiting case or Unicode differences in email or identifier strings.
Why this severity
The vulnerability has a CVSS score of 9.1 (Critical) due to its network‑adjacent attack vector, low complexity, no required privileges or user interaction, and high impact on confidentiality and integrity.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.