CVE-2026-82263

Received Received - Intake

Server-Side Request Forgery in Logto via OIDC SSO Connector

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82263

EUVD

EUVD-2026-67794

Affected Vendors & Products

Vendor	Product	Version / Range
logto	logto	1.42.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-82263 is a Server-Side Request Forgery (SSRF) vulnerability in Logto versions 1.42.0 and earlier. It exists in the OIDC SSO connector creation endpoint where the issuer URL parameter is not properly validated. Tenant administrators with Management API credentials can exploit this by supplying arbitrary internal URLs to trigger HTTP GET requests to private network services. The responses from these requests are returned in API responses, potentially exposing sensitive internal information.

Detection Guidance

Monitor API logs for suspicious OIDC SSO connector creation requests with internal URLs. Check for HTTP GET requests to private IPs or internal domains originating from Logto management endpoints. Review responses containing internal service data.

Impact Analysis

This vulnerability allows attackers with Management API access to access internal network services, potentially exposing sensitive data like configuration details, internal APIs, or other confidential information. It could also be used to probe internal networks for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, and failure to meet regulatory standards for data security and access controls.

Mitigation Strategies

Upgrade Logto to the latest version beyond 1.42.0. Restrict Management API access to trusted IPs. Validate issuer URLs strictly in OIDC SSO connector endpoints. Implement network segmentation to limit internal service exposure.

Hi! I’m here to help you understand CVE-2026-82263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70