CVE-2026-82263highCWE-918

CVE-2026-82263: falha de alta gravidade em logto-io logto

Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar logto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.5%
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
logto-io · logto
CVEs relacionadas — logto-io logto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-62317HIGHLogto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)EPSS 0.7%CVE-2026-63188HIGHlogto-tunnel serves files outside --experience-path via path traversalEPSS 0.5%CVE-2026-82262HIGHLogto Server-Side Request Forgery via webhook test endpointEPSS 0.5%CVE-2026-55377HIGHLogto: Account Center MFA management step-up bypass via WebAuthn registration verificationEPSS 0.4%CVE-2026-63187MEDIUMLogto: OS command injection vulnerability exists in the Commitlint workflowEPSS 0.4%CVE-2026-55789HIGHLogto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service ProvidersEPSS 0.3%