Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: logto-io Clear all filters
TI-2026-56728 CVE-2026-82263 · GHSA-2c8c-r4jf-gp34

Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

Priority HIGH 69

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00459 Published 2026-08-28 No fix listed CWE-918
TI-2026-56727 CVE-2026-82262 · GHSA-2442-5g74-2q7v

Logto Server-Side Request Forgery via webhook test endpoint

Priority LOW 36

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00459 Published 2026-08-28 No fix listed CWE-918
TI-2026-40275 CVE-2026-55789

XML injection in logto-io logto

Priority HIGH 70

Logto is the modern, open-source auth infrastructure for SaaS and AI apps.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00344 Published 2026-07-10 Fixed in 1.41.0 CWE-1395