Logto vulnerabilities
We track 5 vulnerabilities in Logto products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest Logto vulnerabilities
- 9.1 Critical severity
Logto: Improper Handling of Case Sensitivity
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
- 9.1 Critical severity
Logto: Use of Single-factor Authentication
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
- 7.5 High severity
Logto: Insufficient Verification of Data Authenticity
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
- 9.1 Critical severity
Logto: Insufficient Verification of Data Authenticity
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
- 9.1 Critical severity
Logto: Improper Authentication
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.