Logto performs principal lookup without normalizing email and identifier strings, which allows an attacker to create or use a case‑ or Unicode‑different identity that collides with a legitimate user account. This flaw enables unauthorized account access by bypassing intended authentication controls and compromising the confidentiality of the victim account, reflecting weaknesses in improper normalization (CWE‑178).

The affected system is Logto; specifically its core component handles principal lookup. Version information is not supplied in the public data set, so any deployment of Logto core components that has not applied the normalization fix remains at risk. Users running older builds without the latest patch should verify their environment for potential exposure.

The CVSS score of 9.1 classifies the vulnerability as critical, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time; the issue is not currently listed in CISA's KEV catalog. The impact of successful exploitation is serious, permitting unauthorized access to another user's account. The likely attack vector occurs during any operation that performs principal lookup—such as login or session validation—which requires the attacker to know or guess an existing user identifier that can be mapped to the same account through a case or Unicode variant. While the external interface is uncertain, organizations that expose the application to untrusted inputs should consider this risk real for their environment.