EUVD-2026-67793
GHSA-2442-5g74-2q7v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires tenant admin credentials (PR:H); SSRF reads internal services crossing a network trust boundary (S:C); no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
AnalysisAI
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Management API token scoped to a tenant administrator role - a high-privilege credential that Logto issues only to explicitly authorized integrations or administrators, not to ordinary end users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 is driven by SC:H (high confidentiality impact on subsequent systems - private-network services), but the PR:H metric is the critical moderating factor: exploitation is gated behind a tenant administrator credential with a valid Management API token, not open to unauthenticated or low-privilege users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Logto to a release that incorporates commit 16f4b2e732d5114ac98646c9370ec6ab61d6ed26, which introduces SSRF blocking for all outbound requests from the core package; the patch is confirmed at https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and audit all tenant administrators holding active Management API tokens and verify your Logto deployment version against 1.42.0 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the t
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to r
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell co
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today