CVE-2026-15617

5th percentile - higher than 5% of all known CVEs

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

The risk is that an attacker can gain unauthorized access to a victim's account by using a similar but non-identical email or identifier.

Upgrade Logto to a version that normalizes email and identifier strings before lookup.