CVE-2026-15614

Description

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.