Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CERT/CC discloses six Logto vulnerabilities, including CVE-2026-15611 and CVE-2026-15616, that enable SSO authentication bypass and MFA skipping. #Logto #SSO #SAML #OIDC #MFABypass #CERTCC http://securityonline.info/logto-vulnerabilities-sso-bypass/
Post summary
CERT/CC has publicly disclosed six Logto vulnerabilities (CVE-2026-15611, CVE-2026-15616) that enable SSO authentication bypass and skip MFA.
CVE-2026-15611 Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized… https://www.cve.org/CVERecord?id=CVE-2026-15611
Post summary
The text is a concise disclosure of CVE‑2026‑15611, describing how unverified email-based SSO linking in Logto can be abused for unauthorized account creation, with no PoC, exploit, patch, or active exploitation reported.