EUVD-2026-48303

| CVE-2026-15614 HIGH

Authentication Bypass by Capture-replay (CWE-294)

2026-07-23 cret@cert.org

GHSA-crqf-jj8w-c292

Information Disclosure

7.5

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 16:23 vuln.today

CVSS changed

Jul 27, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jul 23, 2026 - 16:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 23, 2026 - 16:17 cve.org

HIGH 7.5

DescriptionCVE.org

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

AnalysisAI

Session replay in Logto IdP-initiated SAML sessions allows unauthenticated remote attackers to reuse captured session tokens, leading to unauthorized account access. Affected versions 1.21.0 through 1.37.1 silently fail to delete sessions, enabling replay within the session's validity window. No active exploitation confirmed but the attack requires no user interaction, and EPSS indicates very low exploitation likelihood.