Logto Tunnel CVE-2026-63188

Two specific conditions must both be true for exploitation: (1) The Logto Tunnel CLI must be invoked with the --experience-path flag set to a local directory - without this flag, createStaticFileProxy is never registered and the vulnerable code path is unreachable; and (2) The tunnel port must be network-accessible from the attacker's location - because server.listen(port) binds to all interfaces on most platforms, any host that can route to the port qualifies. Exploitation is read-only: the attacker can read any file accessible to the OS user running logto-tunnel, but cannot write files, execute code, or bypass Logto authentication. The primary limiting factor is the non-default --experience-path deployment mode, which confines the vulnerable population to developers and pipelines explicitly using the custom sign-in experience feature.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) is internally consistent with the description: once the preconditions are met the attack is trivially executable with a single HTTP request and no credentials. EPSS data was not provided in the input, so a quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV, confirming no actively tracked mass exploitation at time of analysis; however, a complete PoC is publicly documented in GHSA-rxjr-6c9q-h67x, meaningfully elevating near-term opportunistic risk above baseline. Real-world exposure is bounded by two non-default requirements - the --experience-path flag must be active and the tunnel port must be reachable from the attacker - which limits the vulnerable population to developers and CI/CD pipelines running custom Logto UI workflows with the port exposed. Within that population the impact is severe: the process can read any file the OS user can access, including .env files, SSH keys, and credentials typically co-located with development projects. Even a small operations team running logto-tunnel on a shared development server with a network-accessible port should treat this as an urgent remediation given the public PoC and zero-authentication requirement.

An attacker identifies a host running logto-tunnel with --experience-path enabled and the tunnel port accessible over the network. They send a crafted HTTP GET request such as GET /../../../home/runner/.env HTTP/1.1 to the tunnel port; the server resolves the path outside the static directory and returns the file contents directly in the HTTP response body. A complete PoC confirming this scenario is publicly documented in GHSA-rxjr-6c9q-h67x, requiring no authentication, no special tooling, and only a single HTTP request.