Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-56739 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and cloud metadata addresses. Custom OAuth2 connectors can use an attacker-selected userInfoEndpoint and forward the OAuth access token in the Authorization header, while OIDC connectors can fetch an attacker-selected jwksUri. The affected operations require tenant administrative configuration access, but they cross the server's network boundary and can expose internal data or upstream provider credentials. This issue is fixed in version 1.43.0.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.2 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26	[email protected]	Source CodeVendor
https://github.com/logto-io/logto/pull/9501	[email protected]	Issue TrackingSource CodeVendor
https://github.com/logto-io/logto/releases/tag/v1.43.0	[email protected]	Release NotesVendor
https://github.com/logto-io/logto/security/advisories/GHSA-3556-624q-c5w3	[email protected]	AdvisoryExploitRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-918	Server-Side Request Forgery (SSRF)	[email protected]

Affected Products

Product	Versions
Logto	<= 1.42.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.43.0moderate effort Workaround:low effort Configure the following environment variable to allowlist trusted addresses for outbound requests: ``` SSRF_ALLOWED_ADDRESSES=10.0.0.0/8,127.0.0.1 ``` This allows webhooks and SSO connectors to reach a trusted endpoint on a private network while keeping all other special-use addresses blocked. Features that accept unauthenticated target URLs, such as CIMD, are disabled while an allowlist is configured.

Product

Versions

Logto

<= 1.42.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.43.0moderate effort
Workaround:low effort
Configure the following environment variable to allowlist trusted addresses for outbound requests: ``` SSRF_ALLOWED_ADDRESSES=10.0.0.0/8,127.0.0.1 ``` This allows webhooks and SSO connectors to reach a trusted endpoint on a private network while keeping all other special-use addresses blocked. Features that accept unauthenticated target URLs, such as CIMD, are disabled while an allowlist is configured.

Change History

1 change record found show changes