CVE-2026-15614

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15614

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15614.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15614

Published

2026-07-23T15:44:11.159Z

Modified

2026-07-28T04:02:34.596977321Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

IdP-initiated SAML sessions not reliably invalidated (replay)

Details

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Database specific

{
    "cna_assigner": "certcc",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15614.json"
}

References

Affected packages

Git / github.com/logto-io/logto

Affected ranges

Type

GIT

Repo

https://github.com/logto-io/logto

Events

Introduced

f48d3a1f9591b3c24eedf9d1339a8b6b618a32e5

Last affected

647bbde232c4ef2980e7ef06dbdd3cda80427031

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.21.0"
        },
        {
            "last_affected": "1.37.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

@logto/account-center@0.*

@logto/account-center@0.1.0

@logto/account@0.*

@logto/account@0.1.0

@logto/account@0.2.0

@logto/api@0.*

@logto/api@0.0.0

@logto/api@1.*

@logto/api@1.30.0

@logto/app-insights@2.*

@logto/app-insights@2.0.1

@logto/app-insights@2.1.0

@logto/connector-alipay-native@1.*

@logto/connector-alipay-native@1.3.1

@logto/connector-alipay-native@1.4.0

@logto/connector-alipay-native@1.4.1

@logto/connector-alipay-native@1.4.2

@logto/connector-alipay-native@1.4.3

@logto/connector-alipay-web@1.*

@logto/connector-alipay-web@1.4.1

@logto/connector-alipay-web@1.5.0

@logto/connector-alipay-web@1.6.0

@logto/connector-alipay-web@1.6.1

@logto/connector-alipay-web@1.6.2

@logto/connector-aliyun-dm@1.*

@logto/connector-aliyun-dm@1.2.1

@logto/connector-aliyun-dm@1.3.0

@logto/connector-aliyun-dm@1.4.0

@logto/connector-aliyun-dm@1.4.1

@logto/connector-aliyun-dm@1.5.0

@logto/connector-aliyun-dm@1.5.1

@logto/connector-aliyun-sms@1.*

@logto/connector-aliyun-sms@1.2.1

@logto/connector-aliyun-sms@1.3.0

@logto/connector-aliyun-sms@1.4.0

@logto/connector-aliyun-sms@1.4.1

@logto/connector-aliyun-sms@1.5.0

@logto/connector-aliyun-sms@1.5.1

@logto/connector-amazon@0.*

@logto/connector-amazon@0.0.0

@logto/connector-amazon@0.1.0

@logto/connector-amazon@0.1.1

@logto/connector-amazon@0.2.0

@logto/connector-amazon@0.3.0

@logto/connector-amazon@0.3.1

@logto/connector-amazon@0.3.2

@logto/connector-apple@1.*

@logto/connector-apple@1.4.1

@logto/connector-apple@1.5.0

@logto/connector-apple@1.6.0

@logto/connector-apple@1.6.1

@logto/connector-apple@1.6.2

@logto/connector-apple@1.6.3

@logto/connector-aws-ses@1.*

@logto/connector-aws-ses@1.2.1

@logto/connector-aws-ses@1.3.0

@logto/connector-aws-ses@1.4.0

@logto/connector-aws-ses@1.4.1

@logto/connector-aws-ses@1.5.0

@logto/connector-aws-ses@1.5.1

@logto/connector-azuread@1.*

@logto/connector-azuread@1.4.1

@logto/connector-azuread@1.4.2

@logto/connector-azuread@1.5.0

@logto/connector-azuread@1.6.0

@logto/connector-azuread@1.6.1

@logto/connector-azuread@1.6.2

@logto/connector-dingtalk-web@0.*

@logto/connector-dingtalk-web@0.2.1

@logto/connector-dingtalk-web@0.3.0

@logto/connector-dingtalk-web@0.4.0

@logto/connector-dingtalk-web@0.4.1

@logto/connector-dingtalk-web@0.4.2

@logto/connector-discord@1.*

@logto/connector-discord@1.4.1

@logto/connector-discord@1.5.0

@logto/connector-discord@1.6.0

@logto/connector-discord@1.6.1

@logto/connector-discord@1.6.2

@logto/connector-facebook@1.*

@logto/connector-facebook@1.4.1

@logto/connector-facebook@1.5.0

@logto/connector-facebook@1.6.0

@logto/connector-facebook@1.6.1

@logto/connector-facebook@1.6.2

@logto/connector-feishu-web@1.*

@logto/connector-feishu-web@1.3.1

@logto/connector-feishu-web@1.4.0

@logto/connector-feishu-web@1.4.1

@logto/connector-feishu-web@1.4.2

@logto/connector-feishu-web@1.4.3

@logto/connector-gatewayapi-sms@1.*

@logto/connector-gatewayapi-sms@1.0.0

@logto/connector-gatewayapi-sms@1.0.1

@logto/connector-gatewayapi-sms@1.1.0

@logto/connector-gatewayapi-sms@1.1.1

@logto/connector-gatewayapi-sms@1.2.0

@logto/connector-gatewayapi-sms@1.2.1

@logto/connector-github@1.*

@logto/connector-github@1.5.1

@logto/connector-github@1.6.0

@logto/connector-github@1.7.0

@logto/connector-github@1.7.1

@logto/connector-github@1.7.2

@logto/connector-gitlab@1.*

@logto/connector-gitlab@1.0.1

@logto/connector-gitlab@1.1.0

@logto/connector-gitlab@1.2.0

@logto/connector-gitlab@1.2.1

@logto/connector-gitlab@1.2.2

@logto/connector-gitlab@1.2.3

@logto/connector-google@1.*

@logto/connector-google@1.6.0

@logto/connector-google@1.6.1

@logto/connector-google@1.7.0

@logto/connector-google@1.8.0

@logto/connector-google@1.8.1

@logto/connector-google@1.8.2

@logto/connector-http-email@0.*

@logto/connector-http-email@0.2.0

@logto/connector-http-email@0.2.1

@logto/connector-http-email@0.3.0

@logto/connector-http-email@0.3.1

@logto/connector-http-email@0.3.2

@logto/connector-http-email@0.4.0

@logto/connector-http-sms@0.*

@logto/connector-http-sms@0.0.0

@logto/connector-http-sms@0.1.0

@logto/connector-http-sms@0.2.0

@logto/connector-huggingface@0.*

@logto/connector-huggingface@0.2.1

@logto/connector-huggingface@0.3.0

@logto/connector-huggingface@0.4.0

@logto/connector-huggingface@0.4.1

@logto/connector-huggingface@0.4.2

@logto/connector-huggingface@0.4.3

@logto/connector-kakao@1.*

@logto/connector-kakao@1.3.1

@logto/connector-kakao@1.4.0

@logto/connector-kakao@1.4.1

@logto/connector-kakao@1.4.2

@logto/connector-kakao@1.4.3

@logto/connector-kit@4.*

@logto/connector-kit@4.1.0

@logto/connector-kit@4.1.1

@logto/connector-kit@4.2.0

@logto/connector-kit@4.3.0

@logto/connector-kit@4.4.0

@logto/connector-kit@4.5.0

@logto/connector-kit@4.6.0

@logto/connector-kit@4.7.0

@logto/connector-kook@0.*

@logto/connector-kook@0.2.1

@logto/connector-kook@0.3.0

@logto/connector-kook@0.4.0

@logto/connector-kook@0.4.1

@logto/connector-kook@0.4.2

@logto/connector-kook@0.4.3

@logto/connector-line@0.*

@logto/connector-line@0.1.0

@logto/connector-line@0.1.1

@logto/connector-line@0.2.0

@logto/connector-line@0.3.0

@logto/connector-line@0.3.1

@logto/connector-line@0.3.2

@logto/connector-linkedin@0.*

@logto/connector-linkedin@0.0.0

@logto/connector-linkedin@0.1.0

@logto/connector-linkedin@0.2.0

@logto/connector-linkedin@0.3.0

@logto/connector-linkedin@0.3.1

@logto/connector-linkedin@0.3.2

@logto/connector-logto-email@1.*

@logto/connector-logto-email@1.2.1

@logto/connector-logto-email@1.3.0

@logto/connector-logto-email@1.3.1

@logto/connector-logto-email@1.3.2

@logto/connector-logto-email@1.3.3

@logto/connector-logto-sms@1.*

@logto/connector-logto-sms@1.2.1

@logto/connector-logto-sms@1.3.0

@logto/connector-logto-sms@1.3.1

@logto/connector-logto-sms@1.3.2

@logto/connector-logto-social-demo@1.*

@logto/connector-logto-social-demo@1.2.1

@logto/connector-logto-social-demo@1.3.0

@logto/connector-logto-social-demo@1.3.1

@logto/connector-logto-social-demo@1.3.2

@logto/connector-logto-social-demo@1.3.3

@logto/connector-mailgun@1.*

@logto/connector-mailgun@1.3.1

@logto/connector-mailgun@1.4.0

@logto/connector-mailgun@1.5.0

@logto/connector-mailgun@1.5.1

@logto/connector-mailgun@1.5.2

@logto/connector-mailgun@1.5.3

@logto/connector-mock-email@2.*

@logto/connector-mock-email@2.1.1

@logto/connector-mock-email@2.2.0

@logto/connector-mock-email@2.2.1

@logto/connector-mock-email@2.3.0

@logto/connector-mock-email@2.3.1

@logto/connector-mock-email@2.3.2

@logto/connector-mock-sms@2.*

@logto/connector-mock-sms@2.1.1

@logto/connector-mock-sms@2.2.0

@logto/connector-mock-sms@2.2.1

@logto/connector-mock-sms@2.3.0

@logto/connector-mock-sms@2.3.1

@logto/connector-mock-sms@2.3.2

@logto/connector-mock-social@1.*

@logto/connector-mock-social@1.3.1

@logto/connector-mock-social@1.4.0

@logto/connector-mock-social@1.5.0

@logto/connector-mock-social@1.5.1

@logto/connector-mock-social@1.5.2

@logto/connector-mock-standard-email@2.*

@logto/connector-mock-standard-email@2.1.1

@logto/connector-mock-standard-email@2.2.0

@logto/connector-mock-standard-email@2.2.1

@logto/connector-mock-standard-email@2.2.2

@logto/connector-mock-standard-email@2.2.3

@logto/connector-naver@1.*

@logto/connector-naver@1.3.1

@logto/connector-naver@1.4.0

@logto/connector-naver@1.4.1

@logto/connector-naver@1.4.2

@logto/connector-naver@1.4.3

@logto/connector-oauth@1.*

@logto/connector-oauth@1.5.1

@logto/connector-oauth@1.6.0

@logto/connector-oauth@1.7.0

@logto/connector-oauth@1.7.1

@logto/connector-oauth@1.7.2

@logto/connector-oauth@1.7.3

@logto/connector-oidc@1.*

@logto/connector-oidc@1.4.1

@logto/connector-oidc@1.5.0

@logto/connector-oidc@1.6.0

@logto/connector-oidc@1.6.1

@logto/connector-oidc@1.6.2

@logto/connector-oidc@1.7.0

@logto/connector-patreon@1.*

@logto/connector-patreon@1.0.1

@logto/connector-patreon@1.1.0

@logto/connector-patreon@1.2.0

@logto/connector-patreon@1.2.1

@logto/connector-patreon@1.2.2

@logto/connector-patreon@1.2.3

@logto/connector-postmark@1.*

@logto/connector-postmark@1.0.1

@logto/connector-postmark@1.1.0

@logto/connector-postmark@1.1.1

@logto/connector-postmark@1.2.0

@logto/connector-postmark@1.2.1

@logto/connector-qq@0.*

@logto/connector-qq@0.1.0

@logto/connector-qq@1.*

@logto/connector-qq@1.0.0

@logto/connector-qq@1.1.0

@logto/connector-qq@1.1.1

@logto/connector-qq@1.1.2

@logto/connector-saml@1.*

@logto/connector-saml@1.2.1

@logto/connector-saml@1.3.0

@logto/connector-saml@1.3.1

@logto/connector-saml@1.3.2

@logto/connector-saml@1.3.3

@logto/connector-sendgrid-email@1.*

@logto/connector-sendgrid-email@1.2.1

@logto/connector-sendgrid-email@1.3.0

@logto/connector-sendgrid-email@1.4.0

@logto/connector-sendgrid-email@1.4.1

@logto/connector-sendgrid-email@1.5.0

@logto/connector-sendgrid-email@1.5.1

@logto/connector-slack@0.*

@logto/connector-slack@0.0.0

@logto/connector-slack@0.1.0

@logto/connector-slack@0.2.0

@logto/connector-slack@0.3.0

@logto/connector-slack@0.3.1

@logto/connector-slack@0.3.2

@logto/connector-smsaero@1.*

@logto/connector-smsaero@1.3.1

@logto/connector-smsaero@1.4.0

@logto/connector-smsaero@1.4.1

@logto/connector-smsaero@1.5.0

@logto/connector-smsaero@1.5.1

@logto/connector-smtp@1.*

@logto/connector-smtp@1.2.1

@logto/connector-smtp@1.3.0

@logto/connector-smtp@1.4.0

@logto/connector-smtp@1.4.1

@logto/connector-smtp@1.5.0

@logto/connector-smtp@1.5.1

@logto/connector-tencent-sms@1.*

@logto/connector-tencent-sms@1.2.1

@logto/connector-tencent-sms@1.3.0

@logto/connector-tencent-sms@1.3.1

@logto/connector-tencent-sms@1.4.0

@logto/connector-tencent-sms@1.4.1

@logto/connector-twilio-sms@1.*

@logto/connector-twilio-sms@1.2.1

@logto/connector-twilio-sms@1.3.0

@logto/connector-twilio-sms@1.3.1

@logto/connector-twilio-sms@1.4.0

@logto/connector-twilio-sms@1.4.1

@logto/connector-vonage-sms@0.*

@logto/connector-vonage-sms@0.0.0

@logto/connector-vonage-sms@0.0.1

@logto/connector-vonage-sms@0.1.0

@logto/connector-vonage-sms@0.1.1

@logto/connector-vonage-sms@0.2.0

@logto/connector-vonage-sms@0.2.1

@logto/connector-wechat-native@1.*

@logto/connector-wechat-native@1.3.1

@logto/connector-wechat-native@1.4.0

@logto/connector-wechat-native@1.4.1

@logto/connector-wechat-native@1.4.2

@logto/connector-wechat-native@1.4.3

@logto/connector-wechat-web@1.*

@logto/connector-wechat-web@1.4.1

@logto/connector-wechat-web@1.5.0

@logto/connector-wechat-web@1.6.0

@logto/connector-wechat-web@1.6.1

@logto/connector-wechat-web@1.6.2

@logto/connector-wecom@0.*

@logto/connector-wecom@0.3.2

@logto/connector-wecom@0.4.0

@logto/connector-wecom@0.5.0

@logto/connector-wecom@0.5.1

@logto/connector-wecom@0.5.2

@logto/connector-x@0.*

@logto/connector-x@0.0.0

@logto/connector-x@0.1.0

@logto/connector-x@0.1.1

@logto/connector-x@0.2.0

@logto/connector-x@0.3.0

@logto/connector-x@0.4.0

@logto/connector-x@0.4.1

@logto/connector-xiaomi@1.*

@logto/connector-xiaomi@1.0.0

@logto/connector-xiaomi@1.0.1

@logto/connector-xiaomi@1.1.0

@logto/connector-xiaomi@1.2.0

@logto/connector-xiaomi@1.2.1

@logto/connector-xiaomi@1.2.2

@logto/connector-yunpian-sms@1.*

@logto/connector-yunpian-sms@1.0.0

@logto/connector-yunpian-sms@1.0.1

@logto/connector-yunpian-sms@1.1.0

@logto/connector-yunpian-sms@1.1.1

@logto/connector-yunpian-sms@1.2.0

@logto/connector-yunpian-sms@1.2.1

@logto/console@1.*

@logto/console@1.18.1

@logto/console@1.19.0

@logto/console@1.20.0

@logto/console@1.21.0

@logto/console@1.22.0

@logto/console@1.22.1

@logto/console@1.23.0

@logto/console@1.24.0

@logto/console@1.25.0

@logto/console@1.26.0

@logto/console@1.27.0

@logto/console@1.28.0

@logto/console@1.29.0

@logto/console@1.30.0

@logto/console@1.31.0

@logto/console@1.32.0

@logto/console@1.33.0

@logto/console@1.34.0

@logto/core-kit@2.*

@logto/core-kit@2.5.2

@logto/core-kit@2.5.3

@logto/core-kit@2.5.4

@logto/core-kit@2.6.0

@logto/core-kit@2.6.1

@logto/core-kit@2.7.0

@logto/core-kit@2.7.1

@logto/core@1.*

@logto/core@1.21.0

@logto/core@1.22.0

@logto/core@1.23.0

@logto/core@1.23.1

@logto/core@1.24.0

@logto/core@1.24.1

@logto/core@1.25.0

@logto/core@1.26.0

@logto/core@1.27.0

@logto/core@1.28.0

@logto/core@1.29.0

@logto/core@1.30.1

@logto/core@1.31.0

@logto/core@1.32.0

@logto/core@1.33.0

@logto/core@1.34.0

@logto/core@1.35.0

@logto/core@1.36.0

@logto/core@1.37.0

@logto/core@1.37.1

@logto/demo-app@1.*

@logto/demo-app@1.4.2

@logto/demo-app@1.5.0

@logto/elements@0.*

@logto/elements@0.0.2

@logto/elements@0.1.0

@logto/experience-legacy@1.*

@logto/experience-legacy@1.10.0

@logto/experience-legacy@1.11.0

@logto/experience-legacy@1.11.1

@logto/experience@1.*

@logto/experience@1.10.0

@logto/experience@1.11.0

@logto/experience@1.11.1

@logto/experience@1.11.2

@logto/experience@1.12.0

@logto/experience@1.13.0

@logto/experience@1.14.0

@logto/experience@1.15.0

@logto/experience@1.16.0

@logto/experience@1.16.1

@logto/experience@1.17.0

@logto/experience@1.18.0

@logto/experience@1.18.1

@logto/experience@1.18.2

@logto/integration-tests@1.*

@logto/integration-tests@1.10.0

@logto/integration-tests@1.11.0

@logto/integration-tests@1.11.1

@logto/integration-tests@1.12.0

@logto/integration-tests@1.13.0

@logto/integration-tests@1.13.1

@logto/integration-tests@1.14.0

@logto/integration-tests@1.15.0

@logto/integration-tests@1.16.0

@logto/integration-tests@1.17.0

@logto/integration-tests@1.18.0

@logto/integration-tests@1.19.0

@logto/language-kit@1.*

@logto/language-kit@1.1.1

@logto/language-kit@1.1.2

@logto/language-kit@1.1.3

@logto/language-kit@1.2.0

@logto/phrases-account-center@0.*

@logto/phrases-account-center@0.1.0

@logto/phrases-experience@1.*

@logto/phrases-experience@1.10.0

@logto/phrases-experience@1.10.1

@logto/phrases-experience@1.11.0

@logto/phrases-experience@1.12.0

@logto/phrases-experience@1.12.1

@logto/phrases-experience@1.12.2

@logto/phrases-experience@1.9.0

@logto/phrases-experience@1.9.1

@logto/phrases@1.*

@logto/phrases@1.14.1

@logto/phrases@1.15.0

@logto/phrases@1.16.0

@logto/phrases@1.17.0

@logto/phrases@1.18.0

@logto/phrases@1.19.0

@logto/phrases@1.20.0

@logto/phrases@1.21.0

@logto/phrases@1.22.0

@logto/phrases@1.23.0

@logto/phrases@1.24.0

@logto/phrases@1.25.0

@logto/phrases@1.26.0

@logto/shared@3.*

@logto/shared@3.1.2

@logto/shared@3.1.3

@logto/shared@3.1.4

@logto/shared@3.2.0

@logto/shared@3.3.0

@logto/shared@3.3.1

@logto/translate@0.*

@logto/translate@0.1.1

@logto/translate@0.1.2

@logto/translate@0.1.3

@logto/translate@0.2.0

@logto/translate@0.2.1

@logto/translate@0.2.10

@logto/translate@0.2.2

@logto/translate@0.2.3

@logto/translate@0.2.4

@logto/translate@0.2.5

@logto/translate@0.2.6

@logto/translate@0.2.7

@logto/translate@0.2.8

@logto/translate@0.2.9

@logto/tunnel@0.*

@logto/tunnel@0.2.2

@logto/tunnel@0.2.3

@logto/tunnel@0.2.4

@logto/tunnel@0.2.5

@logto/tunnel@0.2.6

@logto/tunnel@0.3.0

@logto/tunnel@0.3.1

@logto/tunnel@0.3.2

@logto/tunnel@0.3.3

@logto/tunnel@0.3.4

@logto/tunnel@0.3.5

v1.*

v1.21.0

v1.22.0

v1.23.0

v1.23.1

v1.24.0

v1.24.1

v1.25.0

v1.26.0

v1.27.0

v1.28.0

v1.29.0

v1.30.1

v1.31.0

v1.32.0

v1.33.0

v1.34.0

v1.35.0

v1.36.0

v1.37.0

v1.37.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15614.json"