Logto v1.42.0 Security Update: SSRF, Secret Leakage Fixes

Logto v1.42.0 Security Update Summary Vulnerability Overview 1. SSRF Vulnerability (Outbound Request Security): SSRF protection for the OIDC provider was not enabled by default, potentially allowing unauthorized requests to be relayed to private network relay servers in self-hosted deployments. 2. Sensitive Information Disclosure: Internal application secrets were previously exposed via Management APIs. 3. Email Policy Bypass/Disclosure: The email blocklist policy was previously leaked in responses from the public sign-in experience. 4. Third-Party Access Token Leakage: Third-party access tokens stored via the Account API were retrievable without enforcing the user scope. 5. CAPTCHA Leakage: Account API verification codes were previously sent to blocked email addresses. 6. Redis Cluster Credentials Decoding Issue: A flaw in decoding Redis cluster credentials existed (fixed). 7. TLS Configuration Defect: Redis cluster connections using the protocol did not properly enable TLS. Scope of Impact Logto Versions: Versions prior to v1.42.0 (particularly self-hosted deployments). Affected Components: - OIDC Provider (node-oidc-provider v8 and earlier) - Management APIs - Public sign-in experience - Account API - Redis cluster connections Deployment Environment: Self-hosted deployments are at the highest risk regarding SSRF. Remediation 1. SSRF Protection Enabled by Default: - SSRF protection for OIDC provider outbound requests is now enabled by default. - Note: Self-hosted deployments that need to send validation requests to private network relay servers must explicitly set the environment variable ; otherwise, Logto will fail to start. 2. API Security Hardening: - Internal application secrets are no longer exposed via Management APIs. - The email blocklist policy is no longer returned in public sign-in experience responses. - Retrieving third-party access tokens via the Account API now enforces the user scope. - Account API verification codes are no longer sent to blocked email addresses. - Email and email domain verification now match complete values and perform stricter domain label checks. 3. OIDC Provider Upgrade to node-oidc-provider v9: - When revoking opaque access tokens, all tokens under the same authorization (including refresh tokens) are now revoked simultaneously. - The revocation endpoint now rejects JWT access tokens with . - A new RFC 8414 authorization server metadata endpoint has been added. - The redundant claim has been removed from the token endpoint. - ID tokens no longer include the header. 4. Redis Fixes: - Resolved the issue with decoding Redis cluster credentials. - Redis cluster connections using the protocol now correctly enable TLS. 5. Other Security Fixes: - Fixed handling of Aliyun SMS Hong Kong numbers. - Fixed signature issues with Aliyun SMS Authentication Service (MAS). Upgrade Considerations Database Migration: This version includes schema changes (custom domain verification files, internal indexes, and tables). Run the database migration command before upgrading. Custom ID Token Validation: If your integration performs custom ID token validation, update it to allow for the absence of the claim and the header. POC/Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Logto v1.42.0 Security Update: SSRF, Secret Leakage Fixes

More from this source