CVE-2026-56739
Deferred Deferred - Pending Action

Logto Authentication Bypass via Unvalidated Webhook Destinations

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and cloud metadata addresses. Custom OAuth2 connectors can use an attacker-selected userInfoEndpoint and forward the OAuth access token in the Authorization header, while OIDC connectors can fetch an attacker-selected jwksUri. The affected operations require tenant administrative configuration access, but they cross the server's network boundary and can expose internal data or upstream provider credentials. This issue is fixed in version 1.43.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-56739
EUVD
EUVD-2026-86224

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
logto logto 1.43.0
logto logto to 1.43.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Logto, an open-source auth infrastructure, had a vulnerability in versions prior to 1.43.0 where it fetched administrator-controlled outbound destinations without validating the addresses. This allowed webhook deliveries to reach special-use and cloud metadata addresses. Custom OAuth2 and OIDC connectors could use attacker-selected endpoints, potentially exposing internal data or credentials.

Impact Analysis

This vulnerability could allow an attacker with tenant administrative access to exfiltrate internal data or steal upstream provider credentials by redirecting connections to malicious endpoints. It crosses network boundaries, increasing the risk of data exposure.

Mitigation Strategies

Upgrade Logto to version 1.43.0 or later to address the vulnerability. Review and restrict administrative configurations that allow outbound connections to untrusted destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart