CVE-2026-63188

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.

• CWE-22

• https://github.com/logto-io/logto/commit/5686815955534f803d3d50738259efd0f741e62c
• https://github.com/logto-io/logto/pull/9113
• https://github.com/logto-io/logto/releases/tag/@logto/tunnel@0.3.9
• https://github.com/logto-io/logto/security/advisories/GHSA-rxjr-6c9q-h67x

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63175PlaywrightCapture stored capture-specific configuration and …7.1
• CVE-2026-63177Malcolm is a network traffic analysis tool suite. Prior to v…7.1
• CVE-2026-63178Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Ent…6.5
• CVE-2026-63179Winter CMS is a content management system built on the Larav…4.9
• CVE-2026-6318Use after free in Codecs in Google Chrome prior to 147.0.772…8.8
• CVE-2026-63187Logto is the modern, open-source auth infrastructure for Saa…6.3
• CVE-2026-6319Use after free in Payments in Google Chrome on Android prior…7.5
• CVE-2026-6320The Salon Booking System – Free Version plugin for WordPress…7.5
• CVE-2026-6321fast-uri decoded percent-encoded path separators and dot seg…7.5
• CVE-2026-63219GeoNetwork is a catalog application to manage spatially refe…8.6
• CVE-2026-6322fast-uri normalize() decoded percent-encoded authority delim…7.5
• CVE-2026-63220CodeIgniter is a PHP full-stack web framework. In versions p…4.8