CyberRota Analysis
AI-GeneratedLogto is vulnerable due to its failure to validate the nonce claim in the id_token when absent, allowing attackers to replay authentication tokens and compromise session integrity. This critical flaw poses significant risks to any application relying on OIDC for authentication, particularly those handling sensitive user data. Organizations utilizing Logto for authentication should prioritize immediate remediation to mitigate potential unauthorized access and session hijacking.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.