External risk intelligence

Logto Account Takeover Vulnerability via Unnormalized Identifiers.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-15617

Logto is an identity and access management (IAM) solution designed to handle user authentication, registration, and SSO. As an identity provider, it is by design a public-facing service that must be internet-accessible to facilitate user logins and authentication flows for applications.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Logto, an identity and access management technology, where it improperly handles user identifiers. This flaw could allow unauthorized access to accounts by exploiting differences in character casing or Unicode representation. The primary concern is to confirm if this technology is in use and assess potential exposure.

Logto could allow account access with different identities.
Critical flaw may impact user account security.
Confirm Logto usage and assess exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker can target the Logto identity and access management system, which is typically exposed to the internet. By sending specially crafted requests that bypass normal email and identifier normalization, an attacker can trick the system into recognizing different identities as the same user. This "principal collision" allows an unauthenticated attacker to gain unauthorized access to accounts.

No authentication required.
Mismatched identity strings.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to accounts by attackers who use slightly different identifiers, such as variations in casing or Unicode characters, to impersonate legitimate users. This occurs because Logto processes principal lookups without properly normalizing these strings, potentially leading to a collision where different identities are treated as the same.

User accounts and associated data.
Unauthorized account access via identifier manipulation.
Compromised user sessions and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Logto platform's handling of principal lookups requires attention from teams managing identity and access. The first step is to identify all Logto deployments, confirm their exposure to the internet, and determine if they are critical to business operations. Once accountable owners are identified, a risk-based remediation plan can be developed.

Identity and Access Management team owns.
Verify internet-facing Logto instances.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Logto?

Logto is an identity and access management (IAM) solution. Developers integrate it into their applications to handle essential security tasks like user registration, authentication flows, and single sign-on (SSO). It acts as the gatekeeper for user accounts, verifying identities before granting access to protected services.

What does CVE-2026-15617 mean by principal collision?

This vulnerability, classified as CWE-178 (Improper Handling of Case Sensitivity), occurs because Logto fails to normalize email addresses or usernames. Without normalization, the system may treat strings like 'User@Example.com' and 'user@example.com' as different accounts in one context but the same in another. An attacker exploits this inconsistency to trigger a collision, allowing them to gain unauthorized access to a victim's existing account by manipulating character casing or Unicode variants.

How does an attacker trigger this vulnerability?

An attacker triggers this by submitting a specially crafted identifier, such as a modified email address, during the authentication or login process. The bug specifically involves the lookup phase where Logto fails to standardize input. It is important to note that this does not require a complex exploit payload or previous authentication; the vulnerability relies solely on the system's logic error when comparing the provided input against established user identities.

Is my Logto instance at risk?

According to Halo Surface Signal, Logto is designed to be internet-facing to support authentication for your users. Because of this inherent design, any instance accessible via the public internet should be considered a potential target for this vulnerability. If your Logto deployment is internal-only, the risk is reduced, but it remains a concern if the service is reachable by untrusted parties on your network.

What steps should I take if I run Logto?

Begin by creating a complete inventory of all Logto deployments within your environment. Verify which instances are accessible over the internet versus those that are private. Once you have a clear picture of your footprint, prioritize these assets for a review of your identity management configuration. Work with your team to assess the business impact of these instances while awaiting further guidance or updates to resolve the identifier handling flaw.

References

github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.