Logto CVE-2026-82262

Exploitation requires a Management API token scoped to a tenant administrator role - a high-privilege credential that Logto issues only to explicitly authorized integrations or administrators, not to ordinary end users. The attacker must be able to reach the POST /api/hooks/:id/test API endpoint over the network, which is typically exposed on the same port as the Logto admin API. No special Logto configuration is required beyond the default-enabled webhook feature; the vulnerability exists in all default deployments through 1.42.0. Exploitation is effectively limited to self-hosted deployments where the Logto process has network reachability to internal services - the primary limiting factors are the PR:H credential requirement and host network topology. Unauthenticated users and low-privilege tenant members cannot trigger this endpoint.

The CVSS 4.0 score of 8.2 is driven by SC:H (high confidentiality impact on subsequent systems - private-network services), but the PR:H metric is the critical moderating factor: exploitation is gated behind a tenant administrator credential with a valid Management API token, not open to unauthenticated or low-privilege users. This substantially narrows the realistic attacker population to malicious insiders, compromised admin accounts, or over-permissioned integration tokens. EPSS data was not supplied, and no CISA KEV listing exists, indicating no confirmed widespread active exploitation. The absence of publicly referenced exploit code further moderates urgency from a mass-exploitation perspective. In multi-tenant or cloud-native deployments, the blast radius is nonetheless significant: a single compromised admin token in a self-hosted instance could expose the entire deployment's private network, including AWS/GCP/Azure instance metadata endpoints that carry cloud IAM credentials. Self-hosted Logto operators are the primary concern; cloud-managed instances may benefit from independent network segmentation outside the application layer. The CVSS signal of high confidentiality impact on subsequent systems is credible and should not be discounted despite the privileged-access prerequisite.

A malicious or compromised tenant administrator authenticates with a valid Management API token and sends POST /api/hooks/:id/test with the target URL set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ - the AWS instance metadata endpoint for IAM credentials. The Logto server fetches the URL from within the deployment network, and the cloud credential JSON is returned in the API response body. No public exploit code has been identified, but the attack requires only a standard HTTP client and a valid admin token.