Skip to content
Heist/ feed
Back to feed
Critical

Unverified email-based SSO account linking

Type: advisorySources: OSV

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-15611
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 10:54 UTC · Revision 1

Source evidence

Unverified email-based SSO account linking

core-osv · Original source

Published 23 Jul 2026, 15:45 UTC

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

osv:CVE-2026-15611
Complete source record
{
  "id": "80da8304f79eb37cd146ed9bcbb7a2f08f8f20f4101c0ab9adc97c3c7fd10c3e",
  "url": "https://osv.dev/vulnerability/CVE-2026-15611",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Unverified email-based SSO account linking",
    "summary": "Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.",
    "evidence": "osv:CVE-2026-15611",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-15611",
      "aliases": [
        "CVE-2026-15611"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/logto-io/logto",
              "type": "GIT",
              "events": [
                {
                  "introduced": "76c8bb2fbf1c272acb724f2acce50d9850815d82"
                },
                {
                  "last_affected": "647bbde232c4ef2980e7ef06dbdd3cda80427031"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "1.11.0"
                      },
                      {
                        "last_affected": "1.37.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.37.1",
            "@logto/tunnel@0.3.5",
            "@logto/translate@0.2.10",
            "@logto/phrases-experience@1.12.2",
            "@logto/core@1.37.1",
            "@logto/core-kit@2.7.1",
            "v1.37.0",
            "@logto/translate@0.2.9",
            "@logto/phrases@1.26.0",
            "@logto/integration-tests@1.19.0",
            "@logto/experience@1.18.2",
            "@logto/core@1.37.0",
            "@logto/console@1.34.0",
            "@logto/account@0.2.0",
            "v1.36.0",
            "@logto/tunnel@0.3.4",
            "@logto/translate@0.2.8",
            "@logto/shared@3.3.1",
            "@logto/phrases@1.25.0",
            "@logto/phrases-experience@1.12.1",
            "@logto/integration-tests@1.18.0",
            "@logto/experience@1.18.1",
            "@logto/core@1.36.0",
            "@logto/core-kit@2.7.0",
            "@logto/console@1.33.0",
            "@logto/connector-patreon@1.2.3",
            "@logto/connector-oidc@1.7.0",
            "@logto/connector-oauth@1.7.3",
            "@logto/connector-kook@0.4.3",
            "@logto/connector-huggingface@0.4.3",
            "@logto/connector-gitlab@1.2.3",
            "@logto/connector-apple@1.6.3",
            "v1.35.0",
            "@logto/translate@0.2.7",
            "@logto/phrases@1.24.0",
            "@logto/integration-tests@1.17.0",
            "@logto/experience@1.18.0",
            "@logto/core@1.35.0",
            "@logto/console@1.32.0",
            "@logto/connector-yunpian-sms@1.2.1",
            "@logto/connector-xiaomi@1.2.2",
            "@logto/connector-x@0.4.1",
            "@logto/connector-wecom@0.5.2",
            "@logto/connector-wechat-web@1.6.2",
            "@logto/connector-wechat-native@1.4.3",
            "@logto/connector-vonage-sms@0.2.1",
            "@logto/connector-twilio-sms@1.4.1",
            "@logto/connector-tencent-sms@1.4.1",
            "@logto/connector-smtp@1.5.1",
            "@logto/connector-smsaero@1.5.1",
            "@logto/connector-slack@0.3.2",
            "@logto/connector-sendgrid-email@1.5.1",
            "@logto/connector-saml@1.3.3",
            "@logto/connector-qq@1.1.2",
            "@logto/connector-postmark@1.2.1",
            "@logto/connector-patreon@1.2.2",
            "@logto/connector-oidc@1.6.2",
            "@logto/connector-oauth@1.7.2",
            "@logto/connector-naver@1.4.3",
            "@logto/connector-mock-standard-email@2.2.3",
            "@logto/connector-mock-social@1.5.2",
            "@logto/connector-mock-sms@2.3.2",
            "@logto/connector-mock-email@2.3.2",
            "@logto/connector-mailgun@1.5.3",
            "@logto/connector-logto-social-demo@1.3.3",
            "@logto/connector-logto-email@1.3.3",
            "@logto/connector-linkedin@0.3.2",
            "@logto/connector-line@0.3.2",
            "@logto/connector-kook@0.4.2",
            "@logto/connector-kit@4.7.0",
            "@logto/connector-kakao@1.4.3",
            "@logto/connector-huggingface@0.4.2",
            "@logto/connector-http-sms@0.2.0",
            "@logto/connector-http-email@0.4.0",
            "@logto/connector-google@1.8.2",
            "@logto/connector-gitlab@1.2.2",
            "@logto/connector-github@1.7.2",
            "@logto/connector-gatewayapi-sms@1.2.1",
            "@logto/connector-feishu-web@1.4.3",
            "@logto/connector-facebook@1.6.2",
            "@logto/connector-discord@1.6.2",
            "@logto/connector-dingtalk-web@0.4.2",
            "@logto/connector-azuread@1.6.2",
            "@logto/connector-aws-ses@1.5.1",
            "@logto/connector-apple@1.6.2",
            "@logto/connector-amazon@0.3.2",
            "@logto/connector-aliyun-sms@1.5.1",
            "@logto/connector-aliyun-dm@1.5.1",
            "@logto/connector-alipay-web@1.6.2",
            "@logto/connector-alipay-native@1.4.3",
            "@logto/account@0.1.0",
            "v1.34.0",
            "@logto/translate@0.2.6",
            "@logto/phrases@1.23.0",
            "@logto/integration-tests@1.16.0",
            "@logto/experience@1.17.0",
            "@logto/core@1.34.0",
            "@logto/console@1.31.0",
            "@logto/phrases-account-center@0.1.0",
            "@logto/account-center@0.1.0",
            "v1.33.0",
            "@logto/translate@0.2.5",
            "@logto/phrases@1.22.0",
            "@logto/experience@1.16.1",
            "@logto/core@1.33.0",
            "@logto/console@1.30.0",
            "v1.32.0",
            "@logto/translate@0.2.4",
            "@logto/phrases@1.21.0",
            "@logto/phrases-experience@1.12.0",
            "@logto/integration-tests@1.15.0",
            "@logto/experience@1.16.0",
            "@logto/core@1.32.0",
            "@logto/console@1.29.0",
            "@logto/connector-yunpian-sms@1.2.0",
            "@logto/connector-xiaomi@1.2.1",
            "@logto/connector-x@0.4.0",
            "@logto/connector-wecom@0.5.1",
            "@logto/connector-wechat-web@1.6.1",
            "@logto/connector-wechat-native@1.4.2",
            "@logto/connector-vonage-sms@0.2.0",
            "@logto/connector-twilio-sms@1.4.0",
            "@logto/connector-tencent-sms@1.4.0",
            "@logto/connector-smtp@1.5.0",
            "@logto/connector-smsaero@1.5.0",
            "@logto/connector-slack@0.3.1",
            "@logto/connector-sendgrid-email@1.5.0",
            "@logto/connector-saml@1.3.2",
            "@logto/connector-qq@1.1.1",
            "@logto/connector-postmark@1.2.0",
            "@logto/connector-patreon@1.2.1",
            "@logto/connector-oidc@1.6.1",
            "@logto/connector-oauth@1.7.1",
            "@logto/connector-naver@1.4.2",
            "@logto/connector-mock-standard-email@2.2.2",
            "@logto/connector-mock-social@1.5.1",
            "@logto/connector-mock-sms@2.3.1",
            "@logto/connector-mock-email@2.3.1",
            "@logto/connector-mailgun@1.5.2",
            "@logto/connector-logto-social-demo@1.3.2",
            "@logto/connector-logto-sms@1.3.2",
            "@logto/connector-logto-email@1.3.2",
            "@logto/connector-linkedin@0.3.1",
            "@logto/connector-line@0.3.1",
            "@logto/connector-kook@0.4.1",
            "@logto/connector-kit@4.6.0",
            "@logto/connector-kakao@1.4.2",
            "@logto/connector-huggingface@0.4.1",
            "@logto/connector-http-email@0.3.2",
            "@logto/connector-google@1.8.1",
            "@logto/connector-gitlab@1.2.1",
            "@logto/connector-github@1.7.1",
            "@logto/connector-gatewayapi-sms@1.2.0",
            "@logto/connector-feishu-web@1.4.2",
            "@logto/connector-facebook@1.6.1",
            "@logto/connector-discord@1.6.1",
            "@logto/connector-dingtalk-web@0.4.1",
            "@logto/connector-azuread@1.6.1",
            "@logto/connector-aws-ses@1.5.0",
            "@logto/connector-apple@1.6.1",
            "@logto/connector-amazon@0.3.1",
            "@logto/connector-aliyun-sms@1.5.0",
            "@logto/connector-aliyun-dm@1.5.0",
            "@logto/connector-alipay-web@1.6.1",
            "@logto/connector-alipay-native@1.4.2",
            "v1.31.0",
            "@logto/translate@0.2.3",
            "@logto/phrases@1.20.0",
            "@logto/phrases-experience@1.11.0",
            "@logto/integration-tests@1.14.0",
            "@logto/experience@1.15.0",
            "@logto/core@1.31.0",
            "@logto/console@1.28.0",
            "@logto/connector-http-sms@0.1.0",
            "@logto/connector-mock-sms@2.3.0",
            "@logto/connector-mock-email@2.3.0",
            "@logto/connector-kit@4.5.0",
            "@logto/connector-http-sms@0.0.0",
            "v1.30.1",
            "@logto/tunnel@0.3.3",
            "@logto/translate@0.2.2",
            "@logto/phrases-experience@1.10.1",
            "@logto/core@1.30.1",
            "@logto/core-kit@2.6.1",
            "@logto/console@1.27.0",
            "@logto/connector-yunpian-sms@1.1.1",
            "@logto/connector-xiaomi@1.2.0",
            "@logto/connector-x@0.3.0",
            "@logto/connector-wecom@0.5.0",
            "@logto/connector-wechat-web@1.6.0",
            "@logto/connector-wechat-native@1.4.1",
            "@logto/connector-vonage-sms@0.1.1",
            "@logto/connector-twilio-sms@1.3.1",
            "@logto/connector-tencent-sms@1.3.1",
            "@logto/connector-smtp@1.4.1",
            "@logto/connector-smsaero@1.4.1",
            "@logto/connector-slack@0.3.0",
            "@logto/connector-sendgrid-email@1.4.1",
            "@logto/connector-saml@1.3.1",
            "@logto/connector-qq@1.1.0",
            "@logto/connector-postmark@1.1.1",
            "@logto/connector-patreon@1.2.0",
            "@logto/connector-oidc@1.6.0",
            "@logto/connector-oauth@1.7.0",
            "@logto/connector-naver@1.4.1",
            "@logto/connector-mock-standard-email@2.2.1",
            "@logto/connector-mock-social@1.5.0",
            "@logto/connector-mock-sms@2.2.1",
            "@logto/connector-mock-email@2.2.1",
            "@logto/connector-mailgun@1.5.1",
            "@logto/connector-logto-social-demo@1.3.1",
            "@logto/connector-logto-sms@1.3.1",
            "@logto/connector-logto-email@1.3.1",
            "@logto/connector-linkedin@0.3.0",
            "@logto/connector-line@0.3.0",
            "@logto/connector-kook@0.4.0",
            "@logto/connector-kit@4.4.0",
            "@logto/connector-kakao@1.4.1",
            "@logto/connector-huggingface@0.4.0",
            "@logto/connector-http-email@0.3.1",
            "@logto/connector-google@1.8.0",
            "@logto/connector-gitlab@1.2.0",
            "@logto/connector-github@1.7.0",
            "@logto/connector-gatewayapi-sms@1.1.1",
            "@logto/connector-feishu-web@1.4.1",
            "@logto/connector-facebook@1.6.0",
            "@logto/connector-discord@1.6.0",
            "@logto/connector-dingtalk-web@0.4.0",
            "@logto/connector-azuread@1.6.0",
            "@logto/connector-aws-ses@1.4.1",
            "@logto/connector-apple@1.6.0",
            "@logto/connector-amazon@0.3.0",
            "@logto/connector-aliyun-sms@1.4.1",
            "@logto/connector-aliyun-dm@1.4.1",
            "@logto/connector-alipay-web@1.6.0",
            "@logto/connector-alipay-native@1.4.1",
            "@logto/api@1.30.0",
            "@logto/api@0.0.0",
            "v1.29.0",
            "@logto/tunnel@0.3.2",
            "@logto/integration-tests@1.13.1",
            "@logto/core@1.29.0",
            "@logto/console@1.26.0",
            "v1.28.0",
            "@logto/tunnel@0.3.1",
            "@logto/translate@0.2.1",
            "@logto/shared@3.3.0",
            "@logto/integration-tests@1.13.0",
            "@logto/experience@1.14.0",
            "@logto/core@1.28.0",
            "@logto/console@1.25.0",
            "@logto/connector-qq@1.0.0",
            "@logto/connector-qq@0.1.0",
            "v1.27.0",
            "@logto/tunnel@0.3.0",
            "@logto/translate@0.2.0",
            "@logto/shared@3.2.0",
            "@logto/phrases@1.19.0",
            "@logto/phrases-experience@1.10.0",
            "@logto/language-kit@1.2.0",
            "@logto/integration-tests@1.12.0",
            "@logto/experience@1.13.0",
            "@logto/elements@0.1.0",
            "@logto/demo-app@1.5.0",
            "@logto/core@1.27.0",
            "@logto/core-kit@2.6.0",
            "@logto/console@1.24.0",
            "@logto/connector-yunpian-sms@1.1.0",
            "@logto/connector-xiaomi@1.1.0",
            "@logto/connector-x@0.2.0",
            "@logto/connector-wecom@0.4.0",
            "@logto/connector-wechat-web@1.5.0",
            "@logto/connector-wechat-native@1.4.0",
            "@logto/connector-vonage-sms@0.1.0",
            "@logto/connector-twilio-sms@1.3.0",
            "@logto/connector-tencent-sms@1.3.0",
            "@logto/connector-smtp@1.4.0",
            "@logto/connector-smsaero@1.4.0",
            "@logto/connector-slack@0.2.0",
            "@logto/connector-sendgrid-email@1.4.0",
            "@logto/connector-saml@1.3.0",
            "@logto/connector-postmark@1.1.0",
            "@logto/connector-patreon@1.1.0",
            "@logto/connector-oidc@1.5.0",
            "@logto/connector-oauth@1.6.0",
            "@logto/connector-naver@1.4.0",
            "@logto/connector-mock-standard-email@2.2.0",
            "@logto/connector-mock-social@1.4.0",
            "@logto/connector-mock-sms@2.2.0",
            "@logto/connector-mock-email@2.2.0",
            "@logto/connector-mailgun@1.5.0",
            "@logto/connector-logto-social-demo@1.3.0",
            "@logto/connector-logto-sms@1.3.0",
            "@logto/connector-logto-email@1.3.0",
            "@logto/connector-linkedin@0.2.0",
            "@logto/connector-line@0.2.0",
            "@logto/connector-kook@0.3.0",
            "@logto/connector-kit@4.3.0",
            "@logto/connector-kakao@1.4.0",
            "@logto/connector-huggingface@0.3.0",
            "@logto/connector-http-email@0.3.0",
            "@logto/connector-google@1.7.0",
            "@logto/connector-gitlab@1.1.0",
            "@logto/connector-github@1.6.0",
            "@logto/connector-gatewayapi-sms@1.1.0",
            "@logto/connector-feishu-web@1.4.0",
            "@logto/connector-facebook@1.5.0",
            "@logto/connector-discord@1.5.0",
            "@logto/connector-dingtalk-web@0.3.0",
            "@logto/connector-azuread@1.5.0",
            "@logto/connector-aws-ses@1.4.0",
            "@logto/connector-apple@1.5.0",
            "@logto/connector-amazon@0.2.0",
            "@logto/connector-aliyun-sms@1.4.0",
            "@logto/connector-aliyun-dm@1.4.0",
            "@logto/connector-alipay-web@1.5.0",
            "@logto/connector-alipay-native@1.4.0",
            "@logto/app-insights@2.1.0",
            "v1.26.0",
            "@logto/translate@0.1.3",
            "@logto/language-kit@1.1.3",
            "@logto/experience@1.12.0",
            "@logto/core@1.26.0",
            "@logto/console@1.23.0",
            "@logto/connector-azuread@1.4.2",
            "@logto/translate@0.1.2",
            "@logto/language-kit@1.1.2",
            "v1.25.0",
            "@logto/core@1.25.0",
            "@logto/console@1.22.1",
            "@logto/connector-x@0.1.1",
            "@logto/connector-smtp@1.3.0",
            "@logto/connector-sendgrid-email@1.3.0",
            "@logto/connector-mailgun@1.4.0",
            "@logto/connector-line@0.1.1",
            "@logto/connector-kit@4.2.0",
            "@logto/connector-aws-ses@1.3.0",
            "@logto/connector-amazon@0.1.1",
            "@logto/connector-aliyun-sms@1.3.0",
            "@logto/connector-aliyun-dm@1.3.0",
            "@logto/tunnel@0.2.6",
            "v1.24.1",
            "@logto/tunnel@0.2.5",
            "@logto/translate@0.1.1",
            "@logto/shared@3.1.4",
            "@logto/phrases@1.18.0",
            "@logto/phrases-experience@1.9.1",
            "@logto/language-kit@1.1.1",
            "@logto/integration-tests@1.11.1",
            "@logto/experience@1.11.2",
            "@logto/experience-legacy@1.11.1",
            "@logto/elements@0.0.2",
            "@logto/demo-app@1.4.2",
            "@logto/core@1.24.1",
            "@logto/core-kit@2.5.4",
            "@logto/console@1.22.0",
            "@logto/connector-yunpian-sms@1.0.1",
            "@logto/connector-xiaomi@1.0.1",
            "@logto/connector-x@0.1.0",
            "@logto/connector-wecom@0.3.2",
            "@logto/connector-wechat-web@1.4.1",
            "@logto/connector-wechat-native@1.3.1",
            "@logto/connector-vonage-sms@0.0.1",
            "@logto/connector-twilio-sms@1.2.1",
            "@logto/connector-tencent-sms@1.2.1",
            "@logto/connector-smtp@1.2.1",
            "@logto/connector-smsaero@1.3.1",
            "@logto/connector-slack@0.1.0",
            "@logto/connector-sendgrid-email@1.2.1",
            "@logto/connector-saml@1.2.1",
            "@logto/connector-postmark@1.0.1",
            "@logto/connector-patreon@1.0.1",
            "@logto/connector-oidc@1.4.1",
            "@logto/connector-oauth@1.5.1",
            "@logto/connector-naver@1.3.1",
            "@logto/connector-mock-standard-email@2.1.1",
            "@logto/connector-mock-social@1.3.1",
            "@logto/connector-mock-sms@2.1.1",
            "@logto/connector-mock-email@2.1.1",
            "@logto/connector-mailgun@1.3.1",
            "@logto/connector-logto-social-demo@1.2.1",
            "@logto/connector-logto-sms@1.2.1",
            "@logto/connector-logto-email@1.2.1",
            "@logto/connector-linkedin@0.1.0",
            "@logto/connector-line@0.1.0",
            "@logto/connector-kook@0.2.1",
            "@logto/connector-kit@4.1.1",
            "@logto/connector-kakao@1.3.1",
            "@logto/connector-huggingface@0.2.1",
            "@logto/connector-http-email@0.2.1",
            "@logto/connector-google@1.6.1",
            "@logto/connector-gitlab@1.0.1",
            "@logto/connector-github@1.5.1",
            "@logto/connector-gatewayapi-sms@1.0.1",
            "@logto/connector-feishu-web@1.3.1",
            "@logto/connector-facebook@1.4.1",
            "@logto/connector-discord@1.4.1",
            "@logto/connector-dingtalk-web@0.2.1",
            "@logto/connector-azuread@1.4.1",
            "@logto/connector-aws-ses@1.2.1",
            "@logto/connector-apple@1.4.1",
            "@logto/connector-amazon@0.1.0",
            "@logto/connector-aliyun-sms@1.2.1",
            "@logto/connector-aliyun-dm@1.2.1",
            "@logto/connector-alipay-web@1.4.1",
            "@logto/connector-alipay-native@1.3.1",
            "@logto/app-insights@2.0.1",
            "@logto/connector-amazon@0.0.0",
            "@logto/connector-linkedin@0.0.0",
            "@logto/connector-slack@0.0.0",
            "@logto/connector-x@0.0.0",
            "v1.24.0",
            "@logto/phrases@1.17.0",
            "@logto/core@1.24.0",
            "@logto/console@1.21.0",
            "@logto/tunnel@0.2.4",
            "@logto/shared@3.1.3",
            "@logto/core-kit@2.5.3",
            "@logto/connector-http-email@0.2.0",
            "v1.23.1",
            "@logto/experience@1.11.1",
            "@logto/core@1.23.1",
            "v1.23.0",
            "@logto/tunnel@0.2.3",
            "@logto/phrases@1.16.0",
            "@logto/integration-tests@1.11.0",
            "@logto/experience@1.11.0",
            "@logto/experience-legacy@1.11.0",
            "@logto/core@1.23.0",
            "@logto/core-kit@2.5.2",
            "@logto/console@1.20.0",
            "@logto/connector-yunpian-sms@1.0.0",
            "@logto/connector-xiaomi@1.0.0",
            "v1.22.0",
            "@logto/phrases@1.15.0",
            "@logto/phrases-experience@1.9.0",
            "@logto/integration-tests@1.10.0",
            "@logto/experience@1.10.0",
            "@logto/experience-legacy@1.10.0",
            "@logto/core@1.22.0",
            "@logto/console@1.19.0",
            "@logto/connector-kit@4.1.0",
            "@logto/connector-vonage-sms@0.0.0",
            "v1.21.0",
            "@logto/tunnel@0.2.2",
            "@logto/shared@3.1.2",
            "@logto/phrases@1.14.1",
            "@logto/core@1.21.0",
            "@logto/console@1.18.1",
            "@logto/connector-google@1.6.0",
            "@logto/connector-gatewayapi-sms@1.0.0",
            "@logto/connector-gatewayapi-sms@0.0.0",
            "@logto/tunnel@0.2.1",
            "@logto/core-kit@2.5.1",
            "@logto/connector-http-email@0.1.0",
            "v1.20.0",
            "@logto/translate@0.1.0",
            "@logto/phrases@1.14.0",
            "@logto/phrases-experience@1.8.0",
            "@logto/integration-tests@1.9.0",
            "@logto/experience@1.9.0",
            "@logto/experience-legacy@1.9.0",
            "@logto/elements@0.0.1",
            "@logto/demo-app@1.4.1",
            "@logto/core@1.20.0",
            "@logto/console@1.18.0",
            "@logto/connector-wecom@0.3.1",
            "@logto/connector-patreon@1.0.0",
            "@logto/connector-oauth@1.5.0",
            "@logto/connector-kook@0.2.0",
            "@logto/connector-gitlab@1.0.0",
            "@logto/experience-legacy@1.8.0",
            "@logto/tunnel@0.2.0",
            "@logto/connector-gitlab@0.0.1",
            "@logto/connector-patreon@0.0.1",
            "@logto/tunnel@0.1.0",
            "@logto/tunnel@0.0.0",
            "@logto/translate@0.0.0",
            "@logto/connector-kook@0.1.0",
            "v1.19.0",
            "@logto/phrases@1.13.0",
            "@logto/integration-tests@1.8.0",
            "@logto/experience@1.8.0",
            "@logto/demo-app@1.4.0",
            "@logto/core@1.19.0",
            "@logto/console@1.17.0",
            "@logto/connector-wecom@0.3.0",
            "@logto/connector-wechat-web@1.4.0",
            "@logto/connector-wechat-native@1.3.0",
            "@logto/connector-twilio-sms@1.2.0",
            "@logto/connector-tencent-sms@1.2.0",
            "@logto/connector-smtp@1.2.0",
            "@logto/connector-smsaero@1.3.0",
            "@logto/connector-sendgrid-email@1.2.0",
            "@logto/connector-saml@1.2.0",
            "@logto/connector-oidc@1.4.0",
            "@logto/connector-oauth@1.4.0",
            "@logto/connector-naver@1.3.0",
            "@logto/connector-mock-standard-email@2.1.0",
            "@logto/connector-mock-social@1.3.0",
            "@logto/connector-mock-sms@2.1.0",
            "@logto/connector-mock-email@2.1.0",
            "@logto/connector-mailgun@1.3.0",
            "@logto/connector-logto-social-demo@1.2.0",
            "@logto/connector-logto-sms@1.2.0",
            "@logto/connector-logto-email@1.2.0",
            "@logto/connector-kakao@1.3.0",
            "@logto/connector-huggingface@0.2.0",
            "@logto/connector-google@1.5.0",
            "@logto/connector-github@1.5.0",
            "@logto/connector-feishu-web@1.3.0",
            "@logto/connector-facebook@1.4.0",
            "@logto/connector-discord@1.4.0",
            "@logto/connector-dingtalk-web@0.2.0",
            "@logto/connector-azuread@1.4.0",
            "@logto/connector-aws-ses@1.2.0",
            "@logto/connector-apple@1.4.0",
            "@logto/connector-aliyun-sms@1.2.0",
            "@logto/connector-aliyun-dm@1.2.0",
            "@logto/connector-alipay-web@1.4.0",
            "@logto/connector-alipay-native@1.3.0",
            "@logto/connector-postmark@0.0.0",
            "@logto/connector-postmark@1.0.0",
            "@logto/elements@0.0.0",
            "v1.18.0",
            "@logto/phrases@1.12.0",
            "@logto/phrases-experience@1.7.0",
            "@logto/integration-tests@1.7.0",
            "@logto/experience@1.7.0",
            "@logto/demo-app@1.3.0",
            "@logto/core@1.18.0",
            "@logto/console@1.16.0",
            "@logto/connector-wecom@0.2.1",
            "@logto/connector-wechat-web@1.3.1",
            "@logto/connector-wechat-native@1.2.1",
            "@logto/connector-twilio-sms@1.1.2",
            "@logto/connector-tencent-sms@1.1.2",
            "@logto/connector-smtp@1.1.3",
            "@logto/connector-smsaero@1.2.2",
            "@logto/connector-sendgrid-email@1.1.2",
            "@logto/connector-saml@1.1.2",
            "@logto/connector-oidc@1.3.1",
            "@logto/connector-oauth@1.3.1",
            "@logto/connector-naver@1.2.1",
            "@logto/connector-mock-standard-email@2.0.2",
            "@logto/connector-mock-social@1.2.1",
            "@logto/connector-mock-sms@2.0.2",
            "@logto/connector-mock-email@2.0.2",
            "@logto/connector-mailgun@1.2.2",
            "@logto/connector-logto-social-demo@1.1.2",
            "@logto/connector-logto-sms@1.1.2",
            "@logto/connector-logto-email@1.1.2",
            "@logto/connector-kit@4.0.0",
            "@logto/connector-kakao@1.2.1",
            "@logto/connector-huggingface@0.1.1",
            "@logto/connector-google@1.4.0",
            "@logto/connector-github@1.4.2",
            "@logto/connector-feishu-web@1.2.1",
            "@logto/connector-facebook@1.3.1",
            "@logto/connector-discord@1.3.1",
            "@logto/connector-dingtalk-web@0.1.1",
            "@logto/connector-azuread@1.3.0",
            "@logto/connector-aws-ses@1.1.2",
            "@logto/connector-apple@1.3.1",
            "@logto/connector-aliyun-sms@1.1.2",
            "@logto/connector-aliyun-dm@1.1.2",
            "@logto/connector-alipay-web@1.3.1",
            "@logto/connector-alipay-native@1.2.1",
            "v1.17.0",
            "@logto/phrases@1.11.0",
            "@logto/experience@1.6.2",
            "@logto/core@1.17.0",
            "@logto/core-kit@2.5.0",
            "@logto/console@1.15.0",
            "@logto/connector-github@1.4.1",
            "@logto/connector-dingtalk-web@0.1.0",
            "@logto/connector-dingtalk-web@0.0.0",
            "@logto/connector-dingtalk-web@1.0.0",
            "v1.16.0",
            "@logto/shared@3.1.1",
            "@logto/phrases@1.10.1",
            "@logto/integration-tests@1.6.1",
            "@logto/experience@1.6.1",
            "@logto/core@1.16.0",
            "@logto/console@1.14.0",
            "@logto/connector-oidc@1.3.0",
            "@logto/connector-oauth@1.3.0",
            "@logto/connector-huggingface@0.1.0",
            "@logto/connector-github@1.4.0",
            "@logto/app-insights@2.0.0",
            "@logto/connector-huggingface@0.0.0",
            "v1.15.0",
            "@logto/phrases@1.10.0",
            "@logto/phrases-experience@1.6.1",
            "@logto/integration-tests@1.6.0",
            "@logto/experience@1.6.0",
            "@logto/demo-app@1.2.0",
            "@logto/core@1.15.0",
            "@logto/core-kit@2.4.0",
            "@logto/console@1.13.0",
            "@logto/connector-wecom@0.2.0",
            "@logto/connector-wechat-web@1.3.0",
            "@logto/connector-wechat-native@1.2.0",
            "@logto/connector-twilio-sms@1.1.1",
            "@logto/connector-tencent-sms@1.1.1",
            "@logto/connector-smtp@1.1.2",
            "@logto/connector-smsaero@1.2.1",
            "@logto/connector-sendgrid-email@1.1.1",
            "@logto/connector-saml@1.1.1",
            "@logto/connector-oidc@1.2.0",
            "@logto/connector-oauth@1.2.0",
            "@logto/connector-naver@1.2.0",
            "@logto/connector-mock-standard-email@2.0.1",
            "@logto/connector-mock-social@1.2.0",
            "@logto/connector-mock-sms@2.0.1",
            "@logto/connector-mock-email@2.0.1",
            "@logto/connector-mailgun@1.2.1",
            "@logto/connector-logto-social-demo@1.1.1",
            "@logto/connector-logto-sms@1.1.1",
            "@logto/connector-logto-email@1.1.1",
            "@logto/connector-kit@3.0.0",
            "@logto/connector-kakao@1.2.0",
            "@logto/connector-google@1.3.0",
            "@logto/connector-github@1.3.0",
            "@logto/connector-feishu-web@1.2.0",
            "@logto/connector-facebook@1.3.0",
            "@logto/connector-discord@1.3.0",
            "@logto/connector-azuread@1.2.0",
            "@logto/connector-aws-ses@1.1.1",
            "@logto/connector-apple@1.3.0",
            "@logto/connector-aliyun-sms@1.1.1",
            "@logto/connector-aliyun-dm@1.1.1",
            "@logto/connector-alipay-web@1.3.0",
            "@logto/connector-alipay-native@1.2.0",
            "v1.14.0",
            "@logto/core@1.14.0",
            "@logto/connector-smtp@1.1.1",
            "@logto/connector-apple@1.2.0",
            "@logto/connector-wecom@0.1.0",
            "v1.13.1",
            "@logto/core@1.13.1",
            "@logto/console@1.12.1",
            "v1.13.0",
            "@logto/shared@3.1.0",
            "@logto/phrases@1.9.0",
            "@logto/phrases-experience@1.6.0",
            "@logto/language-kit@1.1.0",
            "@logto/integration-tests@1.5.0",
            "@logto/experience@1.5.0",
            "@logto/demo-app@1.1.0",
            "@logto/core@1.13.0",
            "@logto/core-kit@2.3.0",
            "@logto/console@1.12.0",
            "@logto/connector-wechat-web@1.2.0",
            "@logto/connector-wechat-native@1.1.0",
            "@logto/connector-twilio-sms@1.1.0",
            "@logto/connector-tencent-sms@1.1.0",
            "@logto/connector-smtp@1.1.0",
            "@logto/connector-smsaero@1.2.0",
            "@logto/connector-sendgrid-email@1.1.0",
            "@logto/connector-saml@1.1.0",
            "@logto/connector-oidc@1.1.0",
            "@logto/connector-oauth@1.1.0",
            "@logto/connector-naver@1.1.0",
            "@logto/connector-mock-standard-email@2.0.0",
            "@logto/connector-mock-social@1.1.0",
            "@logto/connector-mock-sms@2.0.0",
            "@logto/connector-mock-email@2.0.0",
            "@logto/connector-mailgun@1.2.0",
            "@logto/connector-logto-social-demo@1.1.0",
            "@logto/connector-logto-sms@1.1.0",
            "@logto/connector-logto-email@1.1.0",
            "@logto/connector-kit@2.1.0",
            "@logto/connector-kakao@1.1.0",
            "@logto/connector-google@1.2.0",
            "@logto/connector-github@1.2.0",
            "@logto/connector-feishu-web@1.1.0",
            "@logto/connector-facebook@1.2.0",
            "@logto/connector-discord@1.2.0",
            "@logto/connector-azuread@1.1.0",
            "@logto/connector-aws-ses@1.1.0",
            "@logto/connector-apple@1.1.0",
            "@logto/connector-aliyun-sms@1.1.0",
            "@logto/connector-aliyun-dm@1.1.0",
            "@logto/connector-alipay-web@1.2.0",
            "@logto/connector-alipay-native@1.1.0",
            "@logto/app-insights@1.4.0",
            "v1.12.0",
            "@logto/phrases@1.8.0",
            "@logto/phrases-experience@1.5.0",
            "@logto/integration-tests@1.4.3",
            "@logto/experience@1.4.0",
            "@logto/core@1.12.0",
            "@logto/core-kit@2.2.1",
            "@logto/console@1.11.0",
            "v1.11.0",
            "@logto/phrases@1.7.0",
            "@logto/phrases-experience@1.4.0",
            "@logto/experience@1.3.0",
            "@logto/core@1.11.0",
            "@logto/console@1.10.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15611.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:28.225280643Z",
      "provider": "osv",
      "references": [
        "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/libraries/verification-helpers/single-sign-on.ts#L274",
        "https://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/verifications/enterprise-sso-verification.ts#L284-L297",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15611.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-15611"
      ],
      "provider_metadata": {
        "cna_assigner": "certcc",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15611.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-15611",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 494763,
  "published_at": "2026-07-23T15:45:48.25+00:00"
}