Logto CVE-2026-82263

Exploitation requires a valid tenant administrator account with Management API credentials (CVSS PR:H). The attacker must be able to call the OIDC SSO connector creation endpoint via the Management API; neither unauthenticated access nor low-privilege tenant user accounts are sufficient. No additional product configuration is required on the attacker side - supplying an arbitrary URL as the issuer parameter is sufficient to trigger the outbound request. The range of reachable internal services depends on the network topology of the Logto deployment: cloud-hosted instances face the highest risk due to cloud metadata endpoint exposure, while air-gapped or tightly network-segmented deployments have a reduced but non-zero internal reconnaissance surface.

The CVSS 4.0 score of 8.2 is driven by network accessibility (AV:N), high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems on the internal network (SC:H), partially offset by the high-privilege prerequisite (PR:H). The PR:H constraint is a genuine and meaningful limiting factor: exploitation requires tenant-admin credentials with Management API access, not a low-privilege or unauthenticated path. In single-tenant self-hosted deployments this typically means a compromised administrator account; in multi-tenant SaaS scenarios it could mean a malicious tenant probing shared host infrastructure. The cloud metadata endpoint exposure (169.254.169.254) is the highest-severity impact channel in cloud-hosted environments, where successful probing can yield IAM credentials and escalate to full cloud account compromise. No EPSS data was provided and the vulnerability is not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. Despite the authentication requirement, the cloud-metadata angle elevates real-world priority for any cloud-hosted Logto deployment significantly above what PR:H alone would suggest.

A tenant administrator with Management API access submits a connector creation request specifying http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the OIDC issuer URL. Logto performs the outbound GET without filtering the destination and returns the cloud IAM credential response body in the API error payload, giving the attacker valid cloud provider credentials. The same technique applies to RFC 1918 service endpoints - for example, targeting an internal Kubernetes API server or a database admin interface accessible on the deployment's private network.