CVE-2026-82263: Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-08
Weakness: CWE-918

Description

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.

Affected products

logto-io logto: through 1.42.0

References

https://github.com/logto-io/logto
https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/sso/OidcConnector/utils.ts
https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26
https://github.com/logto-io/logto/issues/9465
https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-oidc-sso-connector-issuer-url
https://github.com/logto-io/logto/issues/9465

Get alerted when CVE-2026-82263 or the next vulnerability affects your stack