Logto Io
Monthly
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. No public exploit identified at time of analysis; a patch is available upstream via commit 16f4b2e7.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. A patch is available via upstream commit 16f4b2e and no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the tunnel port when the --experience-path flag is active. The Node.js static file proxy passes request.url directly into path.join(staticPath, request.url) followed by fs.open without URL normalization or containment checks, allowing ../ sequences to escape the configured static directory. A working proof-of-concept is publicly documented in GHSA-rxjr-6c9q-h67x; no active exploitation is confirmed in CISA KEV as of the analysis date, and the vendor-released fix is version 0.3.9.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. No public exploit identified at time of analysis; a patch is available upstream via commit 16f4b2e7.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. A patch is available via upstream commit 16f4b2e and no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the tunnel port when the --experience-path flag is active. The Node.js static file proxy passes request.url directly into path.join(staticPath, request.url) followed by fs.open without URL normalization or containment checks, allowing ../ sequences to escape the configured static directory. A working proof-of-concept is publicly documented in GHSA-rxjr-6c9q-h67x; no active exploitation is confirmed in CISA KEV as of the analysis date, and the vendor-released fix is version 0.3.9.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.