CVE-2026-82262highCWE-918

CVE-2026-82262: falha de alta gravidade em logto-io logto

Logto Server-Side Request Forgery via webhook test endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar logto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.5%
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
logto-io · logto
CVEs relacionadas — logto-io logto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-62317HIGHLogto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)EPSS 0.7%CVE-2026-63188HIGHlogto-tunnel serves files outside --experience-path via path traversalEPSS 0.5%CVE-2026-82263HIGHLogto Server-Side Request Forgery via OIDC SSO Connector Issuer URLEPSS 0.5%CVE-2026-55377HIGHLogto: Account Center MFA management step-up bypass via WebAuthn registration verificationEPSS 0.4%CVE-2026-63187MEDIUMLogto: OS command injection vulnerability exists in the Commitlint workflowEPSS 0.4%CVE-2026-55789HIGHLogto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service ProvidersEPSS 0.3%