CVE-2026-15612

Name of the Vulnerable Software and Affected Versions Logto (affected versions not specified)

Description Logto fails to properly validate the OIDC nonce when the nonce claim is missing from the id token. This flaw allows for the replay of authentication tokens and weakens session-binding. OIDC (OpenID Connect) is an identity layer on top of the OAuth 2.0 protocol, and a nonce is a unique string used to prevent replay attacks by ensuring that a token is used only once.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.