CVE-2026-82263

MEDIUM 6.8

Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.

CWE	CWE-918
Vendor	logto-io
Product	logto
Published	Aug 28, 2026
Last Updated	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for logto-io logto

Be the first to know when new medium vulnerabilities affecting logto-io logto are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

logto-io / logto

0 ≤ 1.42.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/logto-io/logto/issues/9465 github.com: https://github.com/logto-io/logto github.com: https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/sso/OidcConnector/utils.ts github.com: https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26 vulncheck.com: https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-oidc-sso-connector-issuer-url

Credits

🔍 George Chen