# CVE-2026-15614: Logto session replay vulnerability in IdP-initiated SAML sessions

Source: https://junglewise.ai/threats/cve-2026-15614-logto-session-replay-vulnerability-in-idp-initiated-saml-sessions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-15614 · Severity: info · CVSS 0 · Published 2026-07-23

Logto, an identity management platform, contains a flaw where it fails to properly invalidate login sessions initiated through external identity providers using the SAML protocol. This could allow an attacker who obtains a session token to reuse it to gain unauthorized access to a user's account as long as the session remains valid. This poses a risk to user data privacy and the overall security of the authentication system.

Technologies: [Logto](https://junglewise.ai/threats/technologies/logto). Vendors: [Logto](https://junglewise.ai/threats/vendors/logto).

## Quick answers

**Is CVE-2026-15614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15614 being exploited in the wild.

**How severe is CVE-2026-15614?** Informational severity, with a CVSS score of 0, published 23 July 2026.

**Which products and versions are affected?** Logto 1.21.0 to 1.37.1.

**Is there a fix for CVE-2026-15614?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15614 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-15614?** Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A session management vulnerability exists in Logto's SAML implementation, specifically within the single sign-on verification helpers. The application fails to properly delete or invalidate session identifiers for IdP-initiated SAML flows upon completion or logout. This root cause allows for session replay attacks, where a valid SAML session token can be reused by an unauthorized party within its original validity window. The issue is located in the core package's single-sign-on.ts library. Affected versions range from 1.21.0 to 1.37.1.

## Affected products

- Logto Logto 1.21.0 to 1.37.1

## Timeline

- 2026-07-23: disclosed: CVE published by NVD/CERT/CC

## References

- [https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts](https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts)

## Related threats

- [Logto Account API authorization bypass for third-party tokens](https://junglewise.ai/threats/cve-2026-63203-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto SSRF in webhook and connector endpoints](https://junglewise.ai/threats/cve-2026-56739-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto server-side request forgery in OIDC connector creation](https://junglewise.ai/threats/cve-2026-82263-logto-server-side-request-forgery-in-oidc-connector-creation)
- [Logto server-side request forgery in webhook test endpoint](https://junglewise.ai/threats/cve-2026-82262-logto-server-side-request-forgery-in-webhook-test-endpoint)
- [Logto account takeover via improper identifier normalization](https://junglewise.ai/threats/cve-2026-15617-logto-account-takeover-via-improper-identifier-normalization)