Authentication Infrastructure Exposure in Logto Tunnel Package

CVE-2026-63188

What is CVE-2026-63188?

The Logto Tunnel npm package has a path traversal vulnerability that allows unauthorized users to access files outside the designated static directory. This occurs when the 'createStaticFileProxy' function does not perform URL normalization and containment checks, permitting attackers to manipulate requests with '../' sequences. If the tunnel port is reachable and the --experience-path option is enabled, these requests can expose sensitive files to unauthenticated individuals. The vulnerability was mitigated in version 0.3.9, which is recommended for all users to prevent potential unauthorized access.

References