← CVE Intelligence

CVE-2026-15614

IdP-initiated SAML sessions not reliably invalidated (replay) PUBLISHED

Description (CNA)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Affected (CNA)

Vendor / productVersions
Logto / Logtoaffected 1.21.0 through 1.37.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.