# CVE-2026-56739: Logto SSRF in webhook and connector endpoints

Source: https://junglewise.ai/threats/cve-2026-56739-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-56739 · Severity: info · Published 2026-09-24

Logto, an open-source authentication platform, allows tenant administrators to configure outbound connections to webhooks and third-party OAuth/SAML connectors without validating that the destination addresses are safe. An attacker with admin access could point these connections to internal network resources or cloud metadata services to read sensitive data, including provider credentials. The vulnerability requires administrative configuration access but enables credential theft and unauthorized access to internal systems. Fixed in version 1.43.0.

Technologies: [Logto](https://junglewise.ai/threats/technologies/logto). Vendors: [Logto](https://junglewise.ai/threats/vendors/logto).

## Quick answers

**Is CVE-2026-56739 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56739 being exploited in the wild.

**How severe is CVE-2026-56739?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** Logto before 1.43.0.

**Is there a fix for CVE-2026-56739?** A patch was published on 2026-08-27: Fix merged to master, version 1.43.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56739 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56739?** Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Server-side request forgery (SSRF) in webhook delivery and enterprise SSO connector configuration where administrator-supplied endpoints are fetched without address validation. The vulnerability affects webhook URLs (packages/core/src/libraries/hook/utils.ts), OAuth2 userInfoEndpoint, OIDC jwksUri, and SAML metadata endpoints. An attacker with tenant admin credentials can reach loopback addresses, private IP ranges, or cloud metadata endpoints (169.254.169.254) and exfiltrate responses including OAuth access tokens and internal credentials. The fix adds IANA special-use address validation at socket connection time and introduces an SSRF_ALLOWED_ADDRESSES allowlist for legitimate internal endpoints.

## Affected products

- Logto Logto before 1.43.0

## Timeline

- 2026-09-24: disclosed
- 2026-08-27: patched: Fix merged to master, version 1.43.0 released

## References

- [https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26](https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26)
- [https://github.com/logto-io/logto/pull/9501](https://github.com/logto-io/logto/pull/9501)

## Related threats

- [Logto Account API authorization bypass for third-party tokens](https://junglewise.ai/threats/cve-2026-63203-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto server-side request forgery in OIDC connector creation](https://junglewise.ai/threats/cve-2026-82263-logto-server-side-request-forgery-in-oidc-connector-creation)
- [Logto server-side request forgery in webhook test endpoint](https://junglewise.ai/threats/cve-2026-82262-logto-server-side-request-forgery-in-webhook-test-endpoint)
- [Logto account takeover via improper identifier normalization](https://junglewise.ai/threats/cve-2026-15617-logto-account-takeover-via-improper-identifier-normalization)
- [Logto MFA bypass during SSO authentication](https://junglewise.ai/threats/cve-2026-15616-logto-mfa-bypass-during-sso-authentication)