CVE Catalog
CVE-2026-15611
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
Risk Assessment
The risk is that an attacker can hijack a victim's account by registering with an external identity provider using the victim's email.
Recommendation
Upgrade Logto to a version that requires email verification before linking SSO accounts.
Original NVD description (English source)
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.