CVE-2026-63188

creationtimestamp| type| source ---|---|--- 2026-08-19 21:15:31+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mthnnlroob2x 2026-08-19 22:35:07+00:00| published-proof-of-concept| https://github.com/logto-io/logto/security/advisories/GHSA-rxjr-6c9q-h67x...

CVE-2026-63188

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...