CVEvulnerability
CVE-2026-82262
8.2 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-08-28
- Last modified
- 2026-09-08
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.2 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-918
Description
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/logto-io/logto github.com
- https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/libraries/hook/utils.ts github.com
- https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26 github.com
- https://github.com/logto-io/logto/issues/9465 github.com
- https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-webhook-test-endpoint www.vulncheck.com