CVE-2026-82263

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.42.1

Description A server-side request forgery (SSRF) issue exists in the OIDC SSO connector creation endpoint. The system fails to validate the issuer URL parameter, allowing tenant administrators with Management API credentials to provide arbitrary internal URLs. This can trigger HTTP GET requests to private network services, with the resulting response content returned in the API responses.

Recommendations Update to a version newer than 1.42.0. Restrict access to the OIDC SSO connector creation endpoint to minimize the risk of exploitation.