critical9.1
CVE-2026-15617
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Uni…
Impact
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.