TL;DR Logto published four security advisories on November 9, 2026, for its open-source identity platform. The worst of these Logto vulnerabilities is rated CVSS 9.1. It lets an attacker with any Apple ID take over a victim's account. Other flaws bypass multi-factor authentication, skip SAML audience checks and crash the developer tunnel. Logto 1.45.0 and earlier contain an Apple sign-in account takeover, an MFA bypass and a SAML authentication bypass.

CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.

Understanding the miniOrange SAML 2.0 Single Sign On Plugin The miniOrange SAML 2.0 Single Sign On (SSO) plugin is a popular solution for WordPress owners who want to integrate their sites with corporate identity providers. By delegating authentication to a trusted SAML identity provider, site administrators can offer a seamless login experience for users across multiple platforms.

SonicWall's SSL VPN authentication flaw affects certain SAML-enabled Gen7 and Gen8 systems. Learn the exposure conditions and firmware response.

CVE-2026-19868 allows attackers with valid credentials to bypass SonicWall SAML MFA, exposing VPNs to unauthorized access despite MFA enforcement.

SonicOS SSLVPN flaw CVE-2026-19868 allows SAML MFA bypass with valid alternate credentials, highlighting critical risks in authentication architecture.

SonicWall VPNs have a SAML bypass vulnerability that undermines MFA, posing serious risks to enterprise authentication security. Immediate patching is crucial.