News, updates, trends and the latest
info you need to know about IT

Overview
Firmware versions 2.7.7 and earlier of the Arris BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints. Although this vulnerability was recently discovered, the majority of in-service gateways are not expected to be running the affected version. Only devices that have not received automated ISP-managed firmware updates since version 2.7.7 in 2020 are vulnerable.
Description
The Arris BGW210-700 is a residential gateway used widely in AT&T deployments to provide routing, wireless networking, and wide-area network (WAN) connectivity for home users. The device exposes a browser-based management interface on the local-area network (LAN) side that allows users to configure WiFi settings, check diagnostics, and run system operations.
Several CGI (Common Gateway Interface) handlers within the BGW210-700’s web interface do not enforce any server-side authentication checks. Although the interface presents an “Access Code” prompt to users, this restriction is entirely implemented through client-side HTML and JavaScript and is not validated by the server before processing requests. As a result, any HTTP client that ignores client-side code can directly access and interact with the underlying CGI endpoints.
The lack of server-side authentication affects multiple configuration and diagnostic pages. The wconfig_unified.ha endpoint returns the plaintext WiFi pre-shared key for all configured SSIDs to any unauthenticated requester. The broadbandconfig.ha endpoint accepts unauthenticated POST requests that directly modify WAN configuration parameters, including settings that persist across device reboots. Additional diagnostic endpoints, such as diag.ha, allow unauthenticated triggering of backend diagnostic jobs.
Impact
This vulnerability allows any unauthenticated user on the LAN, including devices connected to the gateway through the main WiFi network, Guest WiFi network, or LAN ethernet, to read sensitive configuration information and make persistent changes to gateway settings. A local attacker can retrieve the network’s plaintext WiFi password with a single HTTP request and achieve unauthorized access to manipulate, intrude on, and interfere with protected networks.
Solution
This gateway is ISP-managed, so all standard internet-connected devices are expected to have been automatically updated to newer unaffected versions. Users can determine their active version by checking their router’s diagnostic settings via web browser, and optionally contact their ISP to confirm that automatic updates are functioning correctly. Because the vulnerability is limited to the LAN-side management interface, standard network hygiene practices such as isolating untrusted devices, keeping IoT systems updated, and monitoring for the presence of unknown clients can further reduce risk in environments where older firmware may still be present.
Acknowledgements
Thanks to David Weekly for researching and reporting this vulnerability. This document was written by Molly Jaconski.

Self-hosted AI is not some hobbyist science project anymore. It is a real, production-ready alternative. And for most of us, it’s now the smarter move.

Overview
The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, or submit identity assertions without proper cryptographic or validity checks. Collectively, the issues create several paths for unauthorized access across both local and federated sign‑in flows.
Description
Developed by Silverhand Inc., Logto is an identity and access management system for software as a service (SaaS) and AI applications. It provides multi‑tenant authentication, single sign-on (SSO), role-based access control (RBAC), support for openId connect (OIDC), open authorization (OAuth) 2.1, and Security Assertion Markup Language (SAML) authentication. Several vulnerabilities have been identified in Logto’s authentication and SSO components that weaken core identity‑security protections across these protocols.
CVE-2026-15611
Logto allows unverified email-based SSO account linking. If a new SSO login arrives and no existing (issuer, identityId) account is found, Logto searches for a local user by the email address supplied by the identity provider (IdP) and links the SSO identity to that account. Logto does not require the IdP to confirm email_verified before linking, so an attacker who registers the victim’s email at a permissive upstream IdP can take over the victim’s existing account on first login.
CVE-2026-15612
Logto stores a nonce in the connector session at authorization request time and expects the returned id_token to echo it back. The validation check is guarded by if (data.nonce), so when an id_token omits the nonce claim entirely, the check is skipped, even when nonceFromSession is set.
CVE-2026-15614
Logto does not atomically handle IdP-initiated SAML sessions. Session lookup and session deletion are two separate steps, and because the lookup response is returned before the deletion finishes, any deletion errors are silently discarded. Two requests presenting the same session identifier in close succession can both pass the lookup before either deletion completes, allowing the same IdP-initiated assertion to authorize two separate sign-ins.
CVE-2026-15615
Logto’s SAML implementation relies on the samlify library to validate the Conditions element, but samlify’s check is bypassed whenever the Conditions element is absent from the assertion. An attacker who omits Conditions from a forged or replayed assertion bypasses the NotBefore and NotOnOrAfter time window check entirely, and Logto adds no independent validation of its own.
CVE-2026-15616
Logto’s authentication process does not enforce locally configured multi-factor authentication (MFA) when a user signs in via SSO. MFA is bypassed when hasVerifiedSsoIdentity is true. As a result, an attacker with a federated identity from a permissive upstream IdP can bypass the local MFA requirement by signing in through SSO.
CVE-2026-15617
Logto performs strict, unnormalized comparisons on identity attributes (email domains, issuer identifiers, and identity IDs) during SSO flows. The absence of case, whitespace, and Unicode normalization leads to inconsistent domain‑rule enforcement and incorrect resolution of linked identities, allowing sessions to bind to unintended local accounts.
Impact
Collectively, the vulnerabilities in Logto’s authentication and SSO infrastructure fail to implement core identity protections across the OIDC, OAuth 2.1, and SAML protocols. These flaws can interact in ways that allow attackers to evade account‑ownership checks and MFA, replay federated sessions, and inject unvalidated or unsigned identity assertions.
Solution
Mitigations
Unfortunately, Silverhand Inc. could not be reached for coordination of these vulnerabilities. Until a patch is available, administrators can reduce the attack surface by implementing the following defensive measures:
* Where possible, avoid provisioning local accounts with the same email addresses that will be used for federated sign-in, since Logto does not currently expose a setting to disable automatic email-based account linking.
* Avoid using Logto’s “social SAML” connector entirely.
Require MFA at the upstream IdP for all federated sign‑ins.
Enforce strict domain normalization at the IdP or provisioning layer.
Shorten session lifetimes and aggressively invalidate sessions.
Monitor authentication logs for anomalies.
* Place Logto behind an identity‑aware reverse proxy.
Acknowledgements
Thanks to the reporting team:
Zixu (Jason) Zhou (PhD student), Professor David Lie, Ilya Grishchenko (Postdoc), and Xiangyu Guo (PhD student) of the University of Toronto. This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.