# CVE-2026-82263: Logto server-side request forgery in OIDC connector creation

Source: https://junglewise.ai/threats/cve-2026-82263-logto-server-side-request-forgery-in-oidc-connector-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82263 · Severity: medium · CVSS 6.8 · Published 2026-08-28

Logto is an authentication and authorization platform used to manage user access and SSO for SaaS applications. An SSRF vulnerability in the OIDC connector creation endpoint allows tenant administrators with API credentials to trigger unauthorized requests to internal network services, potentially exposing sensitive data or accessing restricted systems.

Technologies: [Logto](https://junglewise.ai/threats/technologies/logto). Vendors: [Logto](https://junglewise.ai/threats/vendors/logto).

## Quick answers

**Is CVE-2026-82263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82263 being exploited in the wild.

**How severe is CVE-2026-82263?** Medium severity, with a CVSS score of 6.8, published 28 August 2026.

**Which products and versions are affected?** Logto through 1.42.0.

**Is there a fix for CVE-2026-82263?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82263 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82263?** Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Authenticated tenant administrators with Management API credentials can supply arbitrary internal URLs, causing the application to issue HTTP GET requests to private network services. The response content from these internal requests is returned in API responses, allowing attackers to probe or extract data from services they should not have direct access to. The issue affects Logto through version 1.42.0.

## Affected products

- Logto Logto through 1.42.0

## Timeline

- 2026-08-28: disclosed

## References

- [https://github.com/logto-io/logto](https://github.com/logto-io/logto)
- [https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/sso/OidcConnector/utils.ts](https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/sso/OidcConnector/utils.ts)

## Related threats

- [Logto Account API authorization bypass for third-party tokens](https://junglewise.ai/threats/cve-2026-63203-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto SSRF in webhook and connector endpoints](https://junglewise.ai/threats/cve-2026-56739-logto-is-the-modern-open-source-auth-infrastructure-for-saas-and)
- [Logto server-side request forgery in webhook test endpoint](https://junglewise.ai/threats/cve-2026-82262-logto-server-side-request-forgery-in-webhook-test-endpoint)
- [Logto account takeover via improper identifier normalization](https://junglewise.ai/threats/cve-2026-15617-logto-account-takeover-via-improper-identifier-normalization)
- [Logto MFA bypass during SSO authentication](https://junglewise.ai/threats/cve-2026-15616-logto-mfa-bypass-during-sso-authentication)