CVE-2026-15616: Local MFA not enforced during SSO sign-in
Published Jul 23, 2026
·Updated
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Affected Software
1 affected component
Logto Logto
Event History
Jul 23, 2026
CVE Published
via MITRE·03:43 PM
Data Sourced
via MITRE·03:43 PM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-15616?
CVE-2026-15616 has a risk rating of 65, indicating a moderate severity level.
2
How do I fix CVE-2026-15616?
To fix CVE-2026-15616, ensure local multi-factor authentication (MFA) is properly enforced during single sign-on (SSO) authentication.
3
What impact does CVE-2026-15616 have on security?
CVE-2026-15616 allows users to bypass second-factor authentication, potentially leading to unauthorized access.
4
Which software is affected by CVE-2026-15616?
CVE-2026-15616 affects Logto software, allowing vulnerabilities in its SSO authentication process.
5
Is there a known exploit for CVE-2026-15616?
As of now, there is no specific exploit publicly known for CVE-2026-15616, but the vulnerability itself poses a significant security risk.