OIDC Nonce Validation Bypass in Logto by Logto.io
CVE-2026-15612

Currently unrated

Key Information:

Vendor: Logto
Status: Logto
Vendor: CVE Published:; 23 July 2026

What is CVE-2026-15612?

The vulnerability allows Logto to bypass OpenID Connect (OIDC) nonce validation when the nonce claim is not included in the id_token. This oversight could enable malicious actors to replay authentication tokens, effectively compromising session binding and raising concerns about the integrity of user sessions.

Affected Version(s)

Logto 1.10.1 <= 1.37.1

References

https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb...

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 23, 2026
Vulnerability Reserved
Jul 13, 2026

CVE-2026-15612 Data

JSON