CVE-2026-56739— Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
Quick assessment
Affected
logto-io logto
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Logto 是专为 SaaS 和 AI 应用打造的现代开源身份认证基础设施。在 1.43.0 版本之前，Logto 会获取由管理员控制的出站目标地址，但未对连接所使用的地址进行验证。具体而言， 中的 Webhook 投递功能可能访问特殊用途地址和云元数据地址；自定义 OAuth2 连接器可接受攻击者选择的 ，并在 头中转发 OAuth 访问令牌；而 OIDC 连接器则可获取攻击者控制的 。尽管上述操作需要租户管理员级别的配置权限，但它们会跨越服务器网络边界，可能导致内部数据或上游身份提供者的凭证泄露。该问题已在 1
Possible ATT&CK Techniques 1 AI
T1041 · Exfiltration Over C2 Channel
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56739
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and cloud metadata addresses. Custom OAuth2 connectors can use an attacker-selected userInfoEndpoint and forward the OAuth access token in the Authorization header, while OIDC connectors can fetch an attacker-selected jwksUri. The affected operations require tenant administrative configuration access, but they cross the server's network boundary and can expose internal data or upstream provider credentials. This issue is fixed in version 1.43.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-56739
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56739
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-56739 (1)
Vendor Advisories for CVE-2026-56739 (1)
Vendor Pages for CVE-2026-56739 (1)
IV. Related Vulnerabilities
Same product: logto
-
CVE-2026-63203
Logto: Account API can disclose stored third-party provider -
CVE-2026-82263
Logto Server-Side Request Forgery via OIDC SSO Connector Iss -
CVE-2026-82262
Logto Server-Side Request Forgery via webhook test endpoint -
CVE-2026-63187
Logto: OS command injection vulnerability exists in the Comm -
CVE-2026-63188
logto-tunnel serves files outside --experience-path via path
Same vendor: logto-io
-
CVE-2026-63203
Logto: Account API can disclose stored third-party provider -
CVE-2026-82263
Logto Server-Side Request Forgery via OIDC SSO Connector Iss -
CVE-2026-82262
Logto Server-Side Request Forgery via webhook test endpoint -
CVE-2026-63187
Logto: OS command injection vulnerability exists in the Comm -
CVE-2026-63188
logto-tunnel serves files outside --experience-path via path
Same weakness: CWE-918
-
CVE-2026-108542
021is elvix-sdk MCP Request index.ts server-side request for -
CVE-2026-108523
Studio-Saelix Sencho git-sources Browse API Endpoint outboun -
CVE-2026-108521
Studio-Saelix Sencho Add Remote Node API Endpoint validation -
CVE-2026-108602
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender -
CVE-2026-27350
WordPress Builderius plugin <= 1.4-beta - Server Side Reques
V. Comments for CVE-2026-56739
No comments yet