# Logto SSO flaws enable account takeover, MFA bypass Published: 2026-07-23 · Severity: high · Sectors: technology Canonical: https://vorant.io/reports/91567505-8c25-5d70-a1b0-6301cb86f7fa/logto-sso-flaws-enable-account-takeover-mfa-bypass > Six unpatched vulnerabilities in Logto's OIDC/SAML/SSO identity pipeline let attackers hijack accounts, bypass MFA, and replay federated sign-ins. CERT/CC disclosed six vulnerabilities in Logto, an identity and access management platform used for SaaS and AI applications, affecting its OIDC, OAuth 2.1, and SAML authentication flows. The flaws stem from weak identity verification logic: Logto links SSO identities to local accounts based solely on email address without confirming the IdP's email_verified flag, skips nonce validation in id_tokens that omit the claim, fails to atomically handle IdP-initiated SAML session deletion (enabling replay), and relies on the samlify library's flawed handling of missing Conditions elements to skip assertion time-window checks. Additionally, MFA can be bypassed entirely for users who authenticate via SSO, and unnormalized string comparisons on identity attributes can cause sessions to bind to unintended accounts. Combined, these issues undermine core guarantees of federated authentication — account-ownership verification, replay protection, assertion validity windows, and MFA enforcement — across both local and SSO-based sign-in flows. An attacker controlling or abusing a permissive upstream IdP could take over victim accounts, replay stale SAML assertions to authorize multiple sessions, or bypass locally configured MFA. Silverhand Inc., the vendor, could not be reached for coordinated disclosure, so no patch is currently available; CERT/CC has published defensive mitigations including avoiding shared email-based local/SSO accounts, disabling the SAML connector, enforcing MFA at the IdP layer, and shortening session lifetimes. This is a vulnerability disclosure with proof-of-concept-level technical detail from academic researchers at the University of Toronto, not a report of active exploitation. Organizations using Logto for identity and access management should treat this as an urgent hardening task given the lack of vendor patch and the breadth of authentication bypass paths across multiple protocols. ## Mentioned in this report - Vulnerabilities: CVE-2026-15611, CVE-2026-15612, CVE-2026-15614, CVE-2026-15615, CVE-2026-15616, CVE-2026-15617 ## Detection guidance (public sample) ### SSO Account Linked to Local Account Without Verified Email ATT&CK: T1550.001 Detects Logto audit log events where an SSO/OIDC/SAML identity is linked to (or authenticates into) an existing local account while the identity provider's email_verified claim is false or absent - the core account-takeover flaw where email match alone is trusted as proof of ownership. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: SSO Account Linked to Local Account Without Verified Email description: Detects Logto (or similar IdP-integrated IAM) audit events where account linking or SSO sign-in succeeds using an identity provider assertion whose email_verified claim is false/missing. This is the behavioural signature of trusting attacker-controlled IdP email claims to take over a victim's local account without proof of ownership. tags: - attack.initial_access - attack.t1550.001 logsource: category: authentication product: logto detection: selection: EventType: - account_link - sso_login_success - identity_bind AuthMethod: - sso - oidc - saml unverified: EmailVerified: - false - 'null' - '' condition: selection and unverified falsepositives: - Legacy or misconfigured identity providers that never populate email_verified for otherwise trusted internal SSO connections - Test/staging IdP configurations that intentionally omit verification claims level: high id: a3f32a7d-4a6d-5697-b308-92842fb55daa status: experimental author: Vorant ``` ### OIDC Authentication Accepted Without Nonce Validation ATT&CK: T1556 Detects OIDC login success events where the id_token processed by the relying party lacked a nonce claim yet authentication still succeeded, indicating nonce validation was skipped rather than enforced - enabling token replay/injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: OIDC Authentication Accepted Without Nonce Validation description: Detects successful OIDC sign-in events logged by the IAM platform where the received id_token has no nonce claim (NonceValidated=false or Nonce missing) but the authentication result is still success. Generalises on the missing-nonce + success combination, the core flaw that lets replayed or forged id_tokens be accepted. tags: - attack.defense_evasion - attack.t1556 logsource: category: authentication product: logto detection: selection: EventType: oidc_login Result: success missing_nonce: Nonce: - 'null' - '' NonceValidated: false condition: selection and missing_nonce falsepositives: - Legacy OIDC clients or mobile SDKs that never send a nonce and are explicitly allow-listed by policy - Non-interactive machine-to-machine OIDC flows using client_credentials that legitimately omit nonce level: medium id: 4df11648-de16-5c72-b814-caf1d25ead53 status: experimental author: Vorant ``` ### SSO Login Success Without MFA Completion on MFA-Required Account ATT&CK: T1078 Detects successful SSO-based authentication for an account configured to require MFA where the MFA challenge step was never completed, indicating MFA enforcement was bypassed because the login was federated through an IdP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: SSO Login Success Without MFA Completion on MFA-Required Account description: Detects sign-in success events where the account/tenant policy requires MFA (MfaRequired=true) but the session was established via an SSO/federated auth method and MfaCompleted is false, showing valid-account access that bypassed locally configured MFA enforcement through the SSO code path. tags: - attack.defense_evasion - attack.t1078 logsource: category: authentication product: logto detection: selection: Result: success AuthMethod: - sso - oidc - saml MfaRequired: true mfa_bypassed: MfaCompleted: false condition: selection and mfa_bypassed falsepositives: - Break-glass or emergency access accounts explicitly exempted from MFA during SSO login - Misconfigured IdP-to-application trust where MFA is intentionally enforced only at the IdP and not reflected in local MfaCompleted flag level: high id: dfbe6c71-17a3-578b-88ab-95e0fa5e906e status: experimental author: Vorant ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. 1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers. Source reporting: https://kb.cert.org/vuls/id/492466 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/91567505-8c25-5d70-a1b0-6301cb86f7fa/logto-sso-flaws-enable-account-takeover-mfa-bypass. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup