The vulnerability exists in Logto core releases up to version 1.42.0. The OIDC SSO connector creation endpoint accepts an issuer URL parameter without proper validation. When privileged tenant administrators supply an arbitrary URL, Logto performs an HTTP GET request to that address and includes the response body in the API response. This flaw meets the definition of Server‑Side Request Forgery (CWE‑918). The flaw could allow an attacker who has Management API credentials to reach internal network services and read their responses. While the CVE description does not explicitly state downstream exploitation, the returned response content enables potential data exfiltration from private resources.

All Logto core server releases up to and including version 1.42.0 are impacted. The flaw appears in the OIDC SSO connector creation endpoint used by tenant administrators who possess Management API credentials. The affected product is Logto Core from logto‑io. No specific sub‑versions beyond 1.42.0 are known.

The flaw carries a CVSS score of 8.2, indicating high severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires an attacker to possess valid Management API credentials for the tenant, after which the attacker can target arbitrary internal URLs. The resolver sends an HTTP GET to the supplied address and returns the payload in the API response. The ability to read internal service responses suggests a potential for data exfiltration; however, this inference is based on the described behavior and not directly confirmed in the CVE description.