Logto, an open‑source authentication platform, has a flaw where administrator‑controlled outbound destinations are fetched without validation. Webhook delivery and custom OAuth2 connectors can therefore request any URL supplied by an attacker, including internal or cloud‑metadata endpoints. The flaw allows an authorized tenant administrator to craft a webhook or connector that triggers the server to query arbitrary internal resources, potentially exposing sensitive data or upstream provider credentials. The weakness is identified by CWE‑918 and is limited to configurations performed by an administrator but results in requests that cross the server’s network boundary.

Logto infrastructure prior to version 1.43.0. The affected product is the Logto platform (logto‑io/logto). All installations using a version older than 1.43.0 are vulnerable.

The CVSS score of 8.5 indicates a high‑severity vulnerability. No EPSS value is available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires tenant administrative access to the configuration UI or API, after which the attacker can define a webhook or connector that forces the Logto server to issue outbound HTTP requests to arbitrary targets. Successful exploitation can result in the disclosure of internal network information or credentials stored in the OAuth access token or JWKS URI. The attack vector is inferred to be initial compromise of a tenant’s administrative account or a privileged configuration change, but the core vulnerability permits the attacker to perform server‑side requests to any network resource reachable from the Logto host.