Description

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private network services, with response content returned in API responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-28T20:20:16.790Z",
  "pubdate": "2026-08-28T20:20:16.790Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Logto versions through 1.42.0 within the OIDC SSO connector creation endpoint. The vulnerability stems from insufficient validation of the issuer URL parameter provided by users with Management API credentials.\nThe flaw allows authenticated tenant administrators to force the Logto server to initiate unauthorized HTTP GET requests to arbitrary destinations, including internal network services and metadata endpoints that are otherwise unreachable from the public internet. By manipulating the issuer URL, an attacker can influence the server's request behavior, potentially exfiltrating sensitive data from the internal network or probing private services.\nThis vulnerability poses a significant risk to internal infrastructure security. The impact includes unauthorized access to internal resources, potential information disclosure of internal configuration details, and the circumvention of network-level security controls. Successful exploitation requires valid Management API credentials, limiting the threat actor profile to compromised or malicious administrative accounts. The vulnerability represents a failure in input sanitization and server-side request validation policies.",
  "technicalDetails": "The vulnerability resides in the Logto OIDC SSO connector configuration logic, specifically within the endpoint responsible for processing and validating the OIDC issuer URL. When a tenant administrator interacts with the Management API to create or update an OIDC SSO configuration, the backend fails to implement a robust allowlist or restrict the protocol and target host of the provided issuer URL.\nThe root cause is the lack of server-side validation regarding the destination domain and network reachability of the provided URL. When an OIDC configuration is submitted, the Logto server performs an automated request to the specified issuer URL to fetch OIDC metadata (typically via the .well-known/openid-configuration endpoint). Because the application does not validate if the destination resolves to an internal (private) IP address or a non-standard port, it becomes a proxy for arbitrary HTTP GET requests.\nThe attack flow follows these steps: First, the attacker authenticates using valid Management API credentials. Second, the attacker initiates a request to the OIDC SSO connector creation endpoint, supplying a malicious URL (e.g., 'http://169.254.169.254/latest/meta-data/' or internal service endpoints) in the issuer parameter. Third, the Logto server, acting on behalf of the attacker, attempts to resolve the URL and fetch the metadata content. Fourth, the server returns the response body or error details generated by the target host back to the attacker, effectively bypassing network isolation.\nThis SSRF allows for several post-exploitation scenarios, including internal port scanning, retrieval of sensitive cloud provider metadata, and interacting with internal management interfaces that rely on implicit trust based on server identity. The vulnerability affects all versions of Logto up to and including 1.42.0. The lack of domain filtering or network-level segmentation between the application component and the internal network facilitates the exploitation of this logic flaw. The vulnerability is triggered during the validation phase of the OIDC connector setup, which requires an active session with Management API privileges, confirming that the attack surface is exposed via authenticated administrative interfaces."
}