Executive brief
Logto is an authentication and authorization platform used to manage user identity and access control. A vulnerability in the webhook testing feature allows tenant administrators to make the Logto server issue HTTP requests to internal private network addresses, potentially exposing sensitive data or services that should only be accessible internally.
Technical details
The POST /api/hooks/:id/test endpoint in Logto through version 1.42.0 contains a server-side request forgery (SSRF) vulnerability due to insufficient host validation on user-supplied URLs. Authenticated users with Management API tokens (tenant administrators) can provide arbitrary URLs to the webhook test endpoint, causing the server to issue HTTP POST requests to internal or private IP addresses. An attacker can retrieve HTTP response bodies from internal services, potentially disclosing sensitive information or service configurations. The vulnerability requires valid Management API credentials to exploit, limiting the attack surface to authenticated administrators.
Affected products
- Logto Logto through 1.42.0
Timeline
- 2026-08-28: disclosed