CVE-2026-15615 in Logto
Summary
by MITRE • 07/23/2026
Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in Logto stems from insufficient validation of SAML <Conditions> elements during authentication processes, creating a critical security flaw that undermines the integrity of single sign-on implementations. This weakness allows malicious actors to manipulate SAML assertions by removing time-based constraints and audience restrictions that are fundamental to SAML security protocols. The absence of proper validation enables attackers to replay valid SAML assertions indefinitely without expiration or audience limitations, effectively bypassing core authentication controls.
From a technical perspective, the flaw resides in Logto's failure to properly parse and validate the <Conditions> element within SAML assertions. This element typically contains crucial attributes including NotBefore and NotOnOrAfter timestamps that define the validity period of an assertion, as well as AudienceRestriction elements that specify which service providers can accept the assertion. When these conditions are stripped or ignored during processing, the system accepts assertions that should have been rejected based on temporal or audience constraints.
The operational impact of this vulnerability extends beyond simple authentication bypasses, creating potential for widespread unauthorized access across systems relying on Logto for SAML-based authentication. Attackers can leverage this weakness to gain persistent access to protected resources by replaying valid assertions that were originally issued for specific time windows and target audiences. This capability directly violates fundamental SAML security principles and creates opportunities for privilege escalation, data exfiltration, and lateral movement within compromised environments.
Security practitioners should note this vulnerability aligns with CWE-295 (Improper Certificate Validation) and CWE-347 (Improper Verification of Cryptographic Signature) categories, as the failure to validate assertion conditions represents a breakdown in proper authentication verification mechanisms. The issue also maps to ATT&CK technique T1566.002 (Phishing: Spearphishing Attachment) when attackers leverage compromised credentials through replay attacks, and T1078.004 (Valid Accounts: Cloud Accounts) when unauthorized access occurs through legitimate but improperly validated authentication tokens.
Mitigation strategies should focus on implementing robust SAML assertion validation that strictly enforces all <Conditions> element requirements including timestamp validation and audience restriction checks. Organizations should update Logto installations to versions containing proper SAML validation mechanisms, implement additional monitoring for unusual authentication patterns, and consider deploying supplementary security controls such as just-in-time provisioning and adaptive authentication policies. Regular security testing of SAML implementations should include validation of condition elements to prevent similar vulnerabilities from being introduced in future deployments.
This vulnerability demonstrates the critical importance of comprehensive protocol validation in identity management systems, where even minor oversights in standard compliance can lead to significant security compromises. The flaw underscores the necessity for thorough security reviews of authentication mechanisms and adherence to established security frameworks that emphasize proper validation of all cryptographic and authentication elements within complex identity protocols.