CVE Watch27 jul 2026

CVE-2026-15616

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unau

CVSS

9.1

Crítico

EPSS

0.3%

p25

KEV

—

Exploit Today

0-100

Publicado: 23 jul 2026 · Última mod.: 27 jul 2026 · CWE-308

EPSS · 30d

0.2%EPSS · 30 días0.3%

2026-07-242026-08-02

Descripción técnica

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

Referencias oficiales

github.comhttps://github.com/logto-io/logto/blob/ea3ede35028dfd0bbb6d7b239623ce0e7f6cdff8/packages/core/src/routes/experience/classes/experience-interaction.ts#L538-L540

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-676118.1 ALT

—

———OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.6h