CVE-2026-82263: Server-Side Request Forgery (SSRF) in logto-io logto

CVE-2026-82263 is a server-side request forgery vulnerability in logto-io's logto product affecting versions up to and including 1.42.0. The vulnerability exists in the OIDC SSO connector creation endpoint, which does not properly validate the issuer URL parameter. An attacker with tenant administrator privileges and Management API credentials can exploit this by providing arbitrary internal URLs, triggering HTTP GET requests to internal services. The responses from these internal requests are then included in the API responses, potentially exposing sensitive internal information.

An attacker with tenant administrator access and Management API credentials can leverage this vulnerability to make the logto server perform unauthorized HTTP GET requests to internal network services. This can lead to exposure of sensitive internal information through the API responses. The vulnerability does not require user interaction and has a high severity score of 8.2, indicating significant risk if exploited.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict tenant administrator and Management API credentials to trusted users only and monitor for suspicious use of the OIDC SSO connector creation endpoint.