CVE-2026-82263CWE-918ssrf

CVE-2026-82263

Medium · published August 29, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00459 · 38.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-29T00:20Z
References (6)
https://github.com/logto-io/logto · [email protected]https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/sso/OidcConnector/utils.ts · [email protected]https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26 · [email protected]https://github.com/logto-io/logto/issues/9465 · [email protected]https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-oidc-sso-connector-issuer-url · [email protected]https://github.com/logto-io/logto/issues/9465 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
    cvelistv5