Description
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Logto | Logto | 1.19.0 – ≤ 1.37.1 | — |
Critical · 9.1
CVE-2026-15616
EUVD-2026-48301GHSA-cv5x-2gg8-4hc7
Local MFA not enforced during SSO sign-in
Published Jul 23, 2026 · Updated Jul 27, 2026 · Assigned by certcc