A critical Server-Side Request Forgery vulnerability in Logto allows authenticated administrators to perform unauthorized requests to internal network segments and cloud metadata services.

The application fails to validate outbound connection addresses for webhooks, custom OAuth2 connectors, and OIDC jwksUri configurations. This Server-Side Request Forgery (CWE-918) vulnerability requires tenant administrative privileges to trigger but enables the attacker to interact with internal infrastructure across the network boundary.

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of the authentication infrastructure. An attacker with administrative access can exfiltrate sensitive internal data, access cloud provider metadata, or intercept upstream provider credentials. With a CVSS score of 8.5, this high-severity flaw represents a major security risk for organizations managing sensitive user identities through Logto.

Immediate Action: Update the Logto installation to version 1.43.0 or later immediately to implement proper address validation for outbound connections.

Proactive Monitoring: Review audit logs for suspicious outbound connection attempts originating from the Logto server, particularly those targeting internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Deploy network-level egress filtering to restrict the Logto server from reaching internal resources, private IP spaces, or cloud metadata services.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize upgrading to version 1.43.0 to neutralize the SSRF vector. Given that this vulnerability permits access to internal network data and credential exfiltration, it is imperative to apply the patch as soon as possible to prevent potential compromise of the broader authentication ecosystem.