---
id: CVE-2026-82262
title: >-
  Logto through 1.42.0 contains a server-side request forgery vulnerability in
  the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host
  validation
summary: >-
  Logto through 1.42.0 contains a server-side request forgery vulnerability in
  the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host
  validation. Tenant administrators with Management API tokens can make the
  server …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-28'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:23:49.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82262'
references:
  - url: 'https://github.com/logto-io/logto'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/libraries/hook/utils.ts
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26
    label: disclosure@vulncheck.com
  - url: 'https://github.com/logto-io/logto/issues/9465'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-webhook-test-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00459
epssPercentile: 0.37174
ingestedAt: '2026-09-08T21:11:12.287Z'
vendor: logto-io
product: logto
affected:
  - logto <= 1.42.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-31T16:23:35.438940Z'
---

## Overview

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.