CERT/CC Warns of Six Logto Vulnerabilities in SSO and MFA Handling

CERT/CC disclosed six vulnerabilities in the Logto identity platform (VU#492466) that can enable account takeover, MFA bypass, token replay, and SAML assertion replay or timing bypasses; no vendor fixes or confirmed exploitation exist yet and administrators are advised to apply mitigations such as enforcing upstream MFA, avoiding email-shared local accounts, shortening sessions, and monitoring auth logs.