Executive brief
Logto, an identity management platform, contains a flaw where it fails to properly invalidate login sessions initiated through external identity providers using the SAML protocol. This could allow an attacker who obtains a session token to reuse it to gain unauthorized access to a user's account as long as the session remains valid. This poses a risk to user data privacy and the overall security of the authentication system.
Technical details
A session management vulnerability exists in Logto's SAML implementation, specifically within the single sign-on verification helpers. The application fails to properly delete or invalidate session identifiers for IdP-initiated SAML flows upon completion or logout. This root cause allows for session replay attacks, where a valid SAML session token can be reused by an unauthorized party within its original validity window. The issue is located in the core package's single-sign-on.ts library. Affected versions range from 1.21.0 to 1.37.1.
Affected products
- Logto Logto 1.21.0 to 1.37.1
Timeline
- 2026-07-23: disclosed: CVE published by NVD/CERT/CC