What is the CVSS score of CVE-2026-15616?

CVE-2026-15616 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-15616?

Within 24 hours: Disable SSO-based authentication or restrict to trusted identity providers only; monitor authentication logs for anomalous SSO logins without MFA. Within 7 days: Implement compensating controls such as conditional access policies requiring device compliance checks or IP whitelisting for SSO sessions; review and enforce session timeouts and re-authentication triggers. Within 30 days: Evaluate vendor updates or patches when available; consider temporarily disabling multi-factor authentication for SSO users if alternative protections are in place, or migrate affected Logto instances to a patched version when released.

CVE-2026-15616

EUVD-2026-48301 CRITICAL

Use of Single-factor Authentication (CWE-308)

2026-07-23 cret@cert.org

GHSA-cv5x-2gg8-4hc7

Authentication Bypass

9.1

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 16:23 vuln.today

CVSS changed

Jul 27, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 23, 2026 - 16:17 cve.org

CRITICAL 9.1

CVE Published

Jul 23, 2026 - 16:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

AnalysisAI

Remote attackers can bypass locally configured multi-factor authentication (MFA) in Logto when users authenticate via Single Sign-On (SSO). Affecting Logto versions 1.19.0 through 1.37.1, the flaw allows an attacker with valid SSO credentials to access user accounts without providing a second factor, leading to unauthorized data access and account manipulation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Disable SSO-based authentication or restrict to trusted identity providers only; monitor authentication logs for anomalous SSO logins without MFA. …

Threat intelligence, references, and detailed analysis are available after sign-in.