CVE-2026-82263

Logto through 1.42.0 is vulnerable to server-side request forgery (CWE-918) in the endpoint that creates OIDC single sign-on connectors, because the issuer URL parameter is not validated. A tenant administrator holding Management API credentials can submit an arbitrary internal URL as the issuer, causing the Logto server to issue attacker-directed HTTP GET requests to private network services. Because the response content is reflected back in the API response, the attacker can read data from internal-only services such as administrative interfaces or cloud instance metadata endpoints, enabling further attacks against the host environment. Any Logto deployment at version 1.42.0 or earlier is affected, with risk concentrated where Management API credentials are held by users or integrations that are not fully trusted. No public proof-of-concept or confirmed exploitation is known; EPSS puts the 30-day exploitation probability at about 0.3% (18th percentile) and the issue is not in CISA KEV.

What to do: Upgrade Logto to a release newer than 1.42.0 (the data specifies no fixed version, so check the vendor advisory for the patched release). Until upgraded, restrict Management API credentials to fully trusted tenant administrators and apply egress filtering so the Logto server cannot reach private network ranges or cloud metadata addresses (e.g., 169.254.169.254) from the connector-creation flow.