The Logto platform includes a server‑side request forgery flaw in the POST /api/hooks/:id/test endpoint. The endpoint accepts a user‑supplied URL and causes the server to issue an HTTP POST to that URL without validating the host, allowing a tenant administrator with a Management API token to instruct the server to contact arbitrary internal addresses and return the response body. This is a classic CWE‑918 SSRF that lets the attacker read data from services reachable only from the Logto host and may serve as a foothold for further compromise.

The vulnerability affects the Logto product (logto‑io:logto) for all releases up to and including version 1.42.0. Deployments on 1.42.0 or earlier are vulnerable; any newer release should be checked for a patch that removes the host validation flaw.

The vulnerability has a CVSS score of 8.2, indicating high impact. No EPSS score is available, and the issue is not listed in CISA KEV. Holding a tenant’s Management API token enables the attacker to identify internal services and retrieve their responses via the test endpoint. The attack vector is internal network probing through HTTP requests, and the lack of host validation makes the exposure severe.