Overview
The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, or submit identity assertions without proper cryptographic or validity checks. Collectively, the issues create several paths for unauthorized access across both local and federated sign‑in flows.
Description
Developed by Silverhand Inc., Logto is an identity and access management system for software as a service (SaaS) and AI applications. It provides multi‑tenant authentication, single sign-on (SSO), role-based access control (RBAC), support for openId connect (OIDC), open authorization (OAuth) 2.1, and Security Assertion Markup Language (SAML) authentication. Several vulnerabilities have been identified in Logto’s authentication and SSO components that weaken core identity‑security protections across these protocols.
CVE-2026-15611
Logto allows unverified email-based SSO account linking. If a new SSO login arrives and no existing (issuer, identityId) account is found, Logto searches for a local user by the email address supplied by the identity provider (IdP) and links the SSO identity to that account. Logto does not require the IdP to confirm email_verified before linking, so an attacker who registers the victim’s email at a permissive upstream IdP can take over the victim’s existing account on first login.
CVE-2026-15612
Logto stores a nonce in the connector session at authorization request time and expects the returned id_token to echo it back. The validation check is guarded by if (data.nonce), so when an id_token omits the nonce claim entirely, the check is skipped, even when nonceFromSession is set.
CVE-2026-15614
Logto does not atomically handle IdP-initiated SAML sessions. Session lookup and session deletion are two separate steps, and because the lookup response is returned before the deletion finishes, any deletion errors are silently discarded. Two requests presenting the same session identifier in close succession can both pass the lookup before either deletion completes, allowing the same IdP-initiated assertion to authorize two separate sign-ins.
CVE-2026-15615
Logto’s SAML implementation relies on the samlify library to validate the Conditions element, but samlify’s check is bypassed whenever the Conditions element is absent from the assertion. An attacker who omits Conditions from a forged or replayed assertion bypasses the NotBefore and NotOnOrAfter time window check entirely, and Logto adds no independent validation of its own.
CVE-2026-15616
Logto’s authentication process does not enforce locally configured multi-factor authentication (MFA) when a user signs in via SSO. MFA is bypassed when hasVerifiedSsoIdentity is true. As a result, an attacker with a federated identity from a permissive upstream IdP can bypass the local MFA requirement by signing in through SSO.
CVE-2026-15617
Logto performs strict, unnormalized comparisons on identity attributes (email domains, issuer identifiers, and identity IDs) during SSO flows. The absence of case, whitespace, and Unicode normalization leads to inconsistent domain‑rule enforcement and incorrect resolution of linked identities, allowing sessions to bind to unintended local accounts.
Impact
Collectively, the vulnerabilities in Logto’s authentication and SSO infrastructure fail to implement core identity protections across the OIDC, OAuth 2.1, and SAML protocols. These flaws can interact in ways that allow attackers to evade account‑ownership checks and MFA, replay federated sessions, and inject unvalidated or unsigned identity assertions.
Solution
Mitigations
Unfortunately, Silverhand Inc. could not be reached for coordination of these vulnerabilities. Until a patch is available, administrators can reduce the attack surface by implementing the following defensive measures:
* Where possible, avoid provisioning local accounts with the same email addresses that will be used for federated sign-in, since Logto does not currently expose a setting to disable automatic email-based account linking.
* Avoid using Logto’s “social SAML” connector entirely.
Require MFA at the upstream IdP for all federated sign‑ins.
Enforce strict domain normalization at the IdP or provisioning layer.
Shorten session lifetimes and aggressively invalidate sessions.
Monitor authentication logs for anomalies.
* Place Logto behind an identity‑aware reverse proxy.
Acknowledgements
Thanks to the reporting team:
Zixu (Jason) Zhou (PhD student), Professor David Lie, Ilya Grishchenko (Postdoc), and Xiangyu Guo (PhD student) of the University of Toronto. This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.

Overview
Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:Program FilesDuplicati 2 directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious files, such as DLLs, in that directory. To mitigate this vulnerability, install Duplicati in the default C:Program Files directory or update to the latest fixed version.
Description
Duplicati is a free, open-source backup solution that stores data across cloud and local storage platforms. On Windows, Duplicati is distributed as an MSI installer. By default, the installer deploys the application to C:Program FilesDuplicati 2, where the directory inherits the standard protected ACLs provided by Windows.
The following vulnerability affects Duplicati v2.3.0.1:
CVE-2026-16157 During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:Program Files is used, the directory is protected by the appropriate ACLs. However, if Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory. As a result, standard local users may have write access to files within the installation directory, allowing an attacker to place malicious files, such as DLLs, that may be loaded by the LocalSystem service, resulting in arbitrary code execution with elevated privileges.
Impact
A local attacker with write access to a non-default Duplicati installation directory can replace or introduce DLLs used by the Duplicati service. Upon service restart, the Windows loader loads the attacker’s DLL before any managed code is executed, allowing arbitrary code to run with NT AUTHORITYSYSTEM privileges.
Solution
Install Duplicati in the default installation directory (C:Program FilesDuplicati 2). If a non-default installation directory is required, ensure it is manually configured with ACLs that provide equivalent protections to those applied under the C:Program Files directory. Additionally, install all vendor patches and updates that address this vulnerability. See Vendor Information for details
Acknowledgements
Thank you to Valton Tahiri for discovering and reporting this vulnerability. This document was written by Bob Kemerer.

Overview
Version 3.5.8 of Analog Way’s Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script.
Description
The Picturall Quad Compact Mark II is a compact, heavy-duty 8K media server developed by Analog Way for video playback and content management in professional audiovisual environments.
The core firmware includes a maintenance script called create_local_installer.sh, and the default script permission allows the low-privileged user, picmedia, to execute it as root and without a password. An attacker creates a malicious Ext4 disk image that contains the file, picturall-version.txt, with a directory traversal string and a payload file. create_local_installer.sh reads input from picturall-version.txt when processing these attacker-supplied disk images. This input is not properly sanitized, allowing an attacker to supply directory traversal sequences. As a result, the attacker can manipulate the script to write files outside of the intended extraction directory and execute a malicious payload.
Because the script executes with root privileges, this behavior enables arbitrary file writes to sensitive system locations such as `/etc/cron.d, a system directory in Unix/Linux operating system used to store system-wide task scheduling files. An attacker can then leverage this capability to execute arbitrary code with root privileges.
Impact
By exploiting this path traversal vulnerability, an attacker with local access to the device can write arbitrary files to privileged locations. This access allows modification of scheduled tasks, and system configuration files. It can also allow the execution of a[RM2.1][MB2.2]rbitrary commands with full system privileges.
An attacker does not need valid root credentials to enable straightforward and repeatable exploitation, resulting in complete system compromise.[RM3.1][MB3.2] This constitutes a Technical Impact = Total under the SSVC framework, meaning:

The vulnerability gives the adversary total control over the behavior of the software or total disclosure of all information on the affected system.

Solution
Analog Way has released version 3.5.9 to address this vulnerability. Users are strongly encouraged to update to the fixed release as soon as possible.
Acknowledgements
Thanks to the reporter James Tully for responsibly disclosing this issue. This document was written by Michael Bragg.