CVE-2026-82262: Logto Server-Side Request Forgery via webhook test endpoint

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-08
Weakness: CWE-918

Description

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

Affected products

logto-io logto: through 1.42.0

References

https://github.com/logto-io/logto
https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/libraries/hook/utils.ts
https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26
https://github.com/logto-io/logto/issues/9465
https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-webhook-test-endpoint

Get alerted when CVE-2026-82262 or the next vulnerability affects your stack