Vulnerability details
CVE-2026-82263
logto-io logto
Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
CVSS 4.0
8.2High
Official description
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
| 6.8Medium | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| logto-io | logto | v ≤ 1.42.0 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/logto-io/logto product
- https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/sso/OidcConnector/utils.ts technical-description
- https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26 patch
- https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-oidc-sso-connector-issuer-url third-party-advisory
- https://github.com/logto-io/logto/issues/9465 issue-tracking
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-28
- Last updated
- 2026-09-24
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.45%
Probability of exploitation in 30 days
39.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side Request Forgery (SSRF)