CVE-2026-82263highCWE-918

CVE-2026-82263: high-severity vulnerability in logto-io logto

Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

Published · Updated

Follow this CVE+ Monitor logto

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.5%
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
logto-io · logto
Related CVEs — logto-io logto

In the same product, most dangerous first.

CVE-2026-62317HIGHLogto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)EPSS 0.7%CVE-2026-63188HIGHlogto-tunnel serves files outside --experience-path via path traversalEPSS 0.5%CVE-2026-82262HIGHLogto Server-Side Request Forgery via webhook test endpointEPSS 0.5%CVE-2026-55377HIGHLogto: Account Center MFA management step-up bypass via WebAuthn registration verificationEPSS 0.4%CVE-2026-63187MEDIUMLogto: OS command injection vulnerability exists in the Commitlint workflowEPSS 0.4%CVE-2026-55789HIGHLogto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service ProvidersEPSS 0.3%