agentprime: logtoEvery new CVE for logto.https://agentprime.io/CVE-2026-56739: Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpointhttps://agentprime.io/advisories/CVE-2026-56739/https://agentprime.io/advisories/CVE-2026-56739/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 15:20:37 GMTCVECVE-2026-63203: Logto: Account API can disclose stored third-party provider tokens without the identities scopehttps://agentprime.io/advisories/CVE-2026-63203/https://agentprime.io/advisories/CVE-2026-63203/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 15:18:32 GMTCVECVE-2026-82263: Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URLhttps://agentprime.io/advisories/CVE-2026-82263/https://agentprime.io/advisories/CVE-2026-82263/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 16:18:48 GMTCVECVE-2026-82262: Logto Server-Side Request Forgery via webhook test endpointhttps://agentprime.io/advisories/CVE-2026-82262/https://agentprime.io/advisories/CVE-2026-82262/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 16:18:47 GMTCVECVE-2026-63187: Logto: OS command injection vulnerability exists in the Commitlint workflowhttps://agentprime.io/advisories/CVE-2026-63187/https://agentprime.io/advisories/CVE-2026-63187/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:49:34 GMTCVECVE-2026-62317: Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)https://agentprime.io/advisories/CVE-2026-62317/https://agentprime.io/advisories/CVE-2026-62317/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:41:23 GMTCVECVE-2026-15611: Unverified email-based SSO account linkinghttps://agentprime.io/advisories/CVE-2026-15611/https://agentprime.io/advisories/CVE-2026-15611/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Jul 2026 15:45:48 GMTCVEcriticalCVE-2026-15612: LOIDC nonce validation bypasshttps://agentprime.io/advisories/CVE-2026-15612/https://agentprime.io/advisories/CVE-2026-15612/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Jul 2026 15:45:27 GMTCVEcriticalCVE-2026-15614: IdP-initiated SAML sessions not reliably invalidated (replay)https://agentprime.io/advisories/CVE-2026-15614/https://agentprime.io/advisories/CVE-2026-15614/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Jul 2026 15:44:11 GMTCVECVE-2026-15615: SAML <Conditions> element not validatedhttps://agentprime.io/advisories/CVE-2026-15615/https://agentprime.io/advisories/CVE-2026-15615/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Jul 2026 15:43:42 GMTCVECVE-2026-15616: Local MFA not enforced during SSO sign-inhttps://agentprime.io/advisories/CVE-2026-15616/https://agentprime.io/advisories/CVE-2026-15616/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Jul 2026 15:43:03 GMTCVEcriticalCVE-2026-15617: Principal/domain lookup without case normalizationhttps://agentprime.io/advisories/CVE-2026-15617/https://agentprime.io/advisories/CVE-2026-15617/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 23 Jul 2026 15:41:29 GMTCVEcriticalCVE-2026-55377: Logto: Account Center MFA management step-up bypass via WebAuthn registration verificationhttps://agentprime.io/advisories/CVE-2026-55377/https://agentprime.io/advisories/CVE-2026-55377/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 19:57:58 GMTCVECVE-2026-55370: Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)https://agentprime.io/advisories/CVE-2026-55370/https://agentprime.io/advisories/CVE-2026-55370/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 19:56:53 GMTCVECVE-2026-55789: Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providershttps://agentprime.io/advisories/CVE-2026-55789/https://agentprime.io/advisories/CVE-2026-55789/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 19:55:37 GMTCVECVE-2026-54714: Logto: XSS via unescaped RelayState in SAML auto-submit formhttps://agentprime.io/advisories/CVE-2026-54714/https://agentprime.io/advisories/CVE-2026-54714/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 19:54:28 GMTCVE