CVE-2026-15614 in Logto
Summary
by MITRE • 07/23/2026
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability represents a critical session management flaw in the Logto identity platform that allows for unauthorized session replay attacks through improper handling of Identity Provider initiated Single Sign-On flows. The core technical issue manifests when users initiate authentication through an Identity Provider and subsequently attempt to log out or when sessions expire naturally, yet the system fails to properly invalidate or clean up the corresponding SAML session state on the identity provider side. This silent failure creates a window of opportunity for attackers to reuse valid session tokens within the session validity period, effectively bypassing intended logout mechanisms and session termination processes.
The vulnerability stems from inadequate session lifecycle management within the SAML authentication flow implementation, specifically in how Logto handles IdP-initiated logout requests or session termination events. When an Identity Provider initiates a SAML session termination event, the system should properly invalidate the corresponding session state on both the identity provider and service provider sides. However, due to missing validation checks or improper error handling, the system silently accepts these termination events without properly cleaning up session state information in its internal session store or communicating the session invalidation to dependent systems. This behavior creates a persistent security gap where legitimate session tokens remain valid even after users have attempted to logout or when sessions should have expired naturally.
The operational impact of this vulnerability extends beyond simple session replay attacks, as it fundamentally undermines the trust model of the authentication system and can lead to unauthorized access to protected resources. Attackers can exploit this weakness by capturing valid SAML assertions within the session validity window and reusing them to gain access to applications and services that rely on Logto for authentication. The silent failure aspect makes detection particularly challenging since administrators may not be aware that sessions are remaining active when they should have been terminated, creating a false sense of security and potentially allowing prolonged unauthorized access to sensitive systems. This vulnerability directly violates the principle of least privilege and can enable privilege escalation attacks if users with elevated permissions maintain access beyond their intended session duration.
Security controls and mitigations for this vulnerability should focus on implementing robust session lifecycle management that properly handles both SP-initiated and IdP-initiated logout scenarios, ensuring that all session state information is consistently invalidated across the entire authentication ecosystem. Organizations should implement comprehensive session monitoring and logging to detect anomalous behavior patterns that might indicate session replay attempts or unauthorized reuse of valid tokens. The implementation should include proper error handling mechanisms that explicitly validate session termination events and maintain audit trails for all session management operations. This vulnerability aligns with CWE-613, which addresses insufficient session expiration, and maps to ATT&CK technique T1531 related to use of unsecured credentials, as the persistent session state enables unauthorized access through valid but improperly managed authentication tokens. Organizations should also consider implementing additional security controls such as session binding, token revocation mechanisms, and regular session cleanup processes to prevent exploitation of this class of vulnerability.