CVE-2026-82262

Logto, an open-source identity and access management platform, through version 1.42.0 is vulnerable to server-side request forgery (CWE-918) in its POST /api/hooks/:id/test endpoint, which accepts arbitrary URLs without validating the destination host. A tenant administrator holding a Management API token can point the hook test at any URL, causing the Logto server to issue an HTTP POST request of the attacker's choosing. Because the request originates from the server, the administrator can probe services on the private network reachable from the Logto host and read the response bodies, gaining visibility into internal services and data. Any Logto deployment at version 1.42.0 or earlier is affected, though exploitation requires an attacker who already holds or can obtain tenant-administrator Management API credentials. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS puts the 30-day exploitation probability at only 0.3%, indicating no known exploitation in the wild.

What to do: Upgrade Logto to a release newer than 1.42.0 as soon as the vendor publishes a patched version, and monitor the project's GitHub releases and security advisories for the fix. In the meantime, restrict Management API tokens to trusted tenant administrators only, and apply egress filtering or network segmentation so the Logto server cannot reach sensitive internal services or cloud metadata endpoints (e.g., 169.254.169.254). Review server logs for POST /api/hooks/:id/test requests targeting internal or unexpected URLs, which would indicate probing or exploitation.