[CVE-2026-15617] Logto performs principal lookup without normalizing email and identifier strings, enabling principal…

Descripción técnica

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

Puntuación CVSS

Score: 9.1/10 — Severidad: CRITICAL — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Debilidades (CWE)

CWE-178

Fuente oficial

Publicado en NIST NVD.