CyberRota Analysis
AI-GeneratedLogto versions up to 1.42.0 are vulnerable to a server-side request forgery (SSRF) flaw in the POST /api/hooks/:id/test endpoint, which allows tenant administrators with Management API tokens to send HTTP POST requests to arbitrary internal URLs without proper host validation. This could lead to unauthorized access to sensitive data from services within the private network. Organizations using Logto should prioritize patching this vulnerability to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.