[CVE-2026-15616] Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass se…

Descripción técnica

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

Puntuación CVSS

Score: 9.1/10 — Severidad: CRITICAL — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Debilidades (CWE)

CWE-308

Fuente oficial

Publicado en NIST NVD.