Logto EUVD-2026-86224

Requires an authenticated tenant administrator with configuration access to outbound-destination settings: specifically the ability to set a webhook delivery URL (including via POST /api/hooks/:id/test), a custom OAuth2 connector userInfoEndpoint, or an OIDC connector jwksUri (SSO discovery/token/userinfo, and SAML IdP metadata are also covered by the fix). Exploitation is limited by that PR:H prerequisite and by whether the deployment's network exposes sensitive internal targets - the highest impact (credential theft) depends on a reachable cloud metadata endpoint like 169.254.169.254. In fixed builds (>=1.43.0) protection is on by default and only bypassable by deliberately listing destinations in SSRF_ALLOWED_ADDRESSES or setting SSRF_PROTECTION_DISABLED=true. Affected: Logto prior to 1.43.0.

The CVSS 4.0 score of 8.5 (HIGH) is driven largely by the subsequent-system impacts (SC:H/SI:H/SA:H) reflecting that the SSRF crosses the server's network boundary, plus a high-privilege precondition (PR:H). The single most important limiting signal is PR:H: exploitation requires tenant administrative configuration access to set webhook URLs, custom OAuth2 connector userInfoEndpoints, or OIDC jwksUri values - this is not an unauthenticated flaw, so the population of potential attackers is restricted to already-privileged tenant admins (or an attacker who has compromised such an account). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision block supplied. The realistic risk is moderate-to-serious in multi-tenant or cloud-hosted Logto deployments where a low-trust tenant admin is not the same trust principal as the infrastructure operator, and especially where the host has access to a cloud metadata endpoint (169.254.169.254) that could yield IAM credentials - but for single-operator self-hosted installs where the only admin is the operator, real-world risk is low because the actor is already trusted. No signals conflict; the main caveat is that the CVSS vector is provider-assigned and the high subsequent-impact metrics assume reachable sensitive internal targets.

A tenant administrator on a shared/multi-tenant Logto deployment configures a custom OAuth2 connector whose userInfoEndpoint points at http://169.254.169.254/latest/meta-data/iam/security-credentials/ (or an internal service), causing Logto to make the request and either forward the OAuth access token in the Authorization header or return the fetched response through the API error, exposing cloud IAM credentials or internal data. The same primitive works via the webhook test endpoint (POST /api/hooks/:id/test) and OIDC jwksUri discovery. No public exploit code is identified, but the technique is well-understood and the patch/advisory describe the exact reachable endpoints.