EUVD-2026-67794
GHSA-2c8c-r4jf-gp34
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Management API is network-accessible but requires high privilege (tenant admin); scope changes because responses from internal network services beyond the Logto boundary are exposed; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
AnalysisAI
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid tenant administrator account with Management API credentials (CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 is driven by network accessibility (AV:N), high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems on the internal network (SC:H), partially offset by the high-privilege prerequisite (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is confirmed in commit 16f4b2e732d5114ac98646c9370ec6ab61d6ed26 (https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26); the exact first patched release version is not confirmed from the provided data, so administrators should upgrade to the latest Logto release published after 1.42.0 and verify its changelog references this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Logto deployments and identify instances running version 1.42.0 or earlier, assess which tenant administrators have active Management API credentials, and review recent webhook and metadata-fetching activity for suspicious URL patterns targeting internal services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the t
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell co
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today