Security Advisory
CVE-2026-15617
9.1
CRITICAL
Vulnerability Description
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
Published Date
July 23, 2026
Official Source
NIST NVD Advisory