CVE-2026-82262 - Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network. - 漏洞详情

漏洞编号：CVE-2026-82262

风险等级：中危

漏洞来源：CVE

CVE 编号：CVE-2026-82262

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-918

发布/更新时间：2026-08-28 / 2026-08-28

漏洞描述

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

漏洞描述

相关链接

相关漏洞