External risk intelligence

Logto SSO MFA Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-15616

Logto is an identity and access management (IAM) solution. As an identity provider, it is designed to be a public-facing service to facilitate authentication, SSO, and user management for applications, making its authentication endpoints inherently internet-facing by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Logto allows unauthorized access by bypassing multi-factor authentication during single sign-on, potentially compromising user accounts.

Bypass multi-factor authentication for unauthorized access.
Identity and access management is critical to security.
Confirm if Logto is in use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by initiating a single sign-on (SSO) process. Since Logto does not enforce locally configured multi-factor authentication (MFA) during this SSO flow, the attacker can bypass the second-factor requirement. This bypass allows the attacker to gain unauthorized access to user accounts.

Publicly accessible authentication endpoints.
Bypassing multi-factor authentication during SSO.
Unauthorized access to accounts.

Live Threat

Current exploitation, exposure, and threat context

Logto's failure to enforce locally configured Multi-Factor Authentication (MFA) during Single Sign-On (SSO) could allow unauthorized access when supported by the advisory's conditions. This bypass could expose system or user data by granting attackers the same level of access as legitimate users.

System and user authentication data at risk.
Unauthorized access via bypassed MFA.
Compromise of account and system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Logto's Single Sign-On (SSO) process impacts who controls user authentication. Application owners are likely responsible for ensuring their integrated applications do not rely solely on Logto for MFA, while platform or infrastructure teams managing Logto itself need to verify its configuration. The initial practical move is to identify all applications integrating with Logto, confirm which ones are internet-facing or handle sensitive data, and then coordinate with application owners for remediation planning.

Application and platform owners should resolve.
Verify Logto's MFA configuration status.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Logto?

Logto is an identity and access management solution used by developers to handle user authentication, identity federation, and single sign-on services for their applications. It serves as a centralized identity provider, acting as the gatekeeper that verifies user credentials before granting access to various protected web services and integrated software.

What is the vulnerability in CVE-2026-15616?

This vulnerability involves a weakness in authentication processes, specifically classified as CWE-308: Use of Multi-Factor Authentication (MFA) Fallback or Bypass. In this case, the Logto platform fails to properly enforce required MFA checks when a user performs a single sign-on. Because the second factor is ignored, the system essentially downgrades to single-factor authentication, which can allow an attacker to gain access without completing the necessary security steps.

How does an attacker trigger this SSO bypass?

An attacker initiates the vulnerability by starting a single sign-on authentication flow within the Logto environment. The flaw is not triggered by traditional password guessing or brute force; rather, it is a logic error where the system neglects to verify the MFA requirement during the specific SSO hand-off. The bypass does not occur if the user logs in through standard local authentication methods that do not involve this specific SSO interaction path.

Do I need to worry about this if my Logto instance is internal?

According to Halo Surface Signal, Logto is intentionally designed as a public-facing service to facilitate authentication for external applications. Even if you host the software internally, its core functionality relies on being reachable via the network to provide SSO services. Because it is meant to be an internet-facing gateway, you should treat the risk as elevated regardless of your current internal network configuration.

What is the first step to address this issue?

Your priority should be identifying every application in your environment that relies on Logto for authentication. Once mapped, coordinate with your application owners to evaluate whether these services handle sensitive data and require strict MFA enforcement. While you wait for official platform updates or configuration guidance, document which integrated systems are most exposed to ensure you can apply fixes immediately when they become available.

References

github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.