Logto, an identity and access management system by Silverhand Inc., has multiple authentication and authorization vulnerabilities affecting its core protocol handling. Key issues include unverified email-based SSO account linking (CVE-2026-15611), nonce validation bypass when the nonce claim is omitted in id_tokens (CVE-2026-15612), non-atomic handling of IdP-initiated SAML sessions allowing replay (CVE-2026-15614), bypass of SAML Conditions element time-window checks when the element is missing (CVE-2026-15615), MFA bypass on SSO sign-ins when federated identity is verified (CVE-2026-15616), and strict but unnormalized identity attribute comparisons causing incorrect account linking (CVE-2026-15617). These vulnerabilities collectively undermine authentication reliability and authorization decisions across OIDC, OAuth 2.1, and SAML protocols, enabling unauthorized access through multiple attack vectors. Silverhand Inc. has not provided a patch or coordinated response, and no official fix is currently available.

The vulnerabilities reduce the reliability of authentication and authorization decisions in Logto, allowing attackers to bypass account-ownership verification, skip local MFA requirements, replay federated SSO assertions, and inject unvalidated or unsigned identity assertions. This can lead to unauthorized access to user accounts and services protected by Logto's identity platform. The issues affect both local and federated sign-in flows and compromise core security guarantees of OIDC, OAuth 2.1, and SAML protocols within the platform.

No official patch or vendor advisory is available as Silverhand Inc. could not be reached for coordination. Until a patch is released, administrators should reduce the attack surface by avoiding provisioning local accounts with emails used for federated sign-in, disabling or avoiding Logto's social SAML connector, requiring MFA at the upstream identity provider for all federated sign-ins, enforcing strict domain normalization at the IdP or provisioning layer, shortening session lifetimes, aggressively invalidating sessions, monitoring authentication logs for anomalies, and placing Logto behind an identity-aware reverse proxy.