CVE Catalog
CVE-2026-15616
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.20%
10th percentile - higher than 10% of all known CVEs
Summary
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Risk Assessment
The risk is that an attacker can bypass multi-factor authentication and gain access to protected resources.
Recommendation
Upgrade Logto to a version that enforces MFA during SSO authentication.
Original NVD description (English source)
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.