Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CERT/CC discloses six Logto vulnerabilities, including CVE-2026-15611 and CVE-2026-15616, that enable SSO authentication bypass and MFA skipping. #Logto #SSO #SAML #OIDC #MFABypass #CERTCC http://securityonline.info/logto-vulnerabilities-sso-bypass/
Post summary
CERT/CC discloses six Logto vulnerabilities (CVE-2026-15611, CVE-2026-15616) that allow bypass of SSO authentication and MFA.
CVE-2026-15616 Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access. https://www.cve.org/CVERecord?id=CVE-2026-15616
Post summary
The post discloses that Logto’s SSO does not enforce locally configured MFA, allowing users to bypass second-factor checks and gain unauthorized access.