Description
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Logto | Logto | 1.10.1 – ≤ 1.37.1 | — |