CVE-2026-82262

MEDIUM 6.8

Logto Server-Side Request Forgery via webhook test endpoint

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

CWE	CWE-918
Vendor	logto-io
Product	logto
Published	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for logto-io logto

Be the first to know when new medium vulnerabilities affecting logto-io logto are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

logto-io / logto

0 ≤ 1.42.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/logto-io/logto/issues/9465 github.com: https://github.com/logto-io/logto github.com: https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/libraries/hook/utils.ts github.com: https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26 vulncheck.com: https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-webhook-test-endpoint

Credits

🔍 George Chen