VULNERABILITY INTELLIGENCE

CVE-2026-15617

CVSS score9.1 CRITICAL

EPSS probability0.43%

CISA KEVNot currently listed

Published2026-07-23

Last modified2026-07-27

Description

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.