Medium severity6.8NVD Advisory· Published Aug 28, 2026· Updated Sep 8, 2026

CVE-2026-82262

Description

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Logto Io/Logtoreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.42.0

Patches

Vulnerability mechanics

References

github.com/logto-io/logto/blob/v1.42.0/packages/core/src/libraries/hook/utils.tsnvd
github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26nvd
github.com/logto-io/logto/issues/9465nvd
www.vulncheck.com/advisories/logto-server-side-request-forgery-via-webhook-test-endpointnvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000