Is CVE-2026-15615 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15615 being exploited in the wild.

How severe is CVE-2026-15615?

Informational severity, published 23 July 2026.

Is there a fix for CVE-2026-15615?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15615 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15615?

Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15615: Logto missing SAML Conditions validation in SAML Connector

CVE-2026-15615 · Severity: info · Published 2026-07-23

Logto, an identity management platform, contains a security flaw in how it handles SAML-based logins. The system fails to check specific security conditions in login tokens, which allows an attacker to reuse old login sessions indefinitely or bypass intended audience restrictions. This could lead to unauthorized account access and persistent sessions that should have expired.

Technologies: Logto. Vendors: Logto.

Quick answers

Is CVE-2026-15615 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15615 being exploited in the wild.
How severe is CVE-2026-15615?: Informational severity, published 23 July 2026.
Which products and versions are affected?: Logto 1.12.0 to 1.37.1.
Is there a fix for CVE-2026-15615?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15615 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15615?: Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Logto fails to validate the SAML <Conditions> element within the SAML connector and core SSO components. This vulnerability allows an attacker to manipulate SAML assertions by removing 'NotBefore' and 'NotOnOrAfter' time constraints, as well as 'AudienceRestriction' elements. Because these conditions are not enforced, an attacker can perform a replay attack, using a previously captured valid assertion to authenticate indefinitely. The issue is located in the SAML connector utility functions and affects versions 1.12.0 through 1.37.1.

Affected products

Logto Logto 1.12.0 to 1.37.1

Timeline

2026-07-23: disclosed
2026-07-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.