Description
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Logto | Logto | 1.12.0 – ≤ 1.37.1 | — |
High · 7.5
CVE-2026-15615
EUVD-2026-48302GHSA-vxqj-8hg5-3v79
SAML <Conditions> element not validated
Published Jul 23, 2026 · Updated Jul 27, 2026 · Assigned by certcc