PT-2026-50678 · Npm · Swagger-Typescript-Api
CVE-2026-54660
·
Published
2026-06-18
·
Updated
2026-07-29
CVSS v3.1
7.4
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
swagger-typescript-api versions prior to 13.12.2
Description
An issue exists where the software forwards the
--authorizationToken to every URL fetched while resolving external $ref URLs in an OpenAPI specification. This occurs because the getRemoteRequestHeaders() function in src/resolved-swagger-schema.ts attaches the token to the Authorization header of all subsequent HTTP requests without performing same-origin checks, host allowlisting, or scope-down for cross-origin requests. Consequently, a malicious OpenAPI specification containing a $ref to an attacker-controlled URL can exfiltrate sensitive credentials, such as GitHub Personal Access Tokens (PAT), OAuth bearer tokens, or enterprise SSO tokens, from the developer's environment or CI/CD pipeline during the code generation process.Recommendations
Update swagger-typescript-api to version 13.12.2.
Exploit
Fix
SSRF
Information Disclosure
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Swagger-Typescript-Api