AIKIDO-2026-11123

TL;DR

swagger-typescript-api resolves external $ref URLs in OpenAPI specifications during code generation and forwards the configured authorization token on every request without any same-origin check, host allowlist, or cross-origin scope-down. When a developer supplies credentials to fetch a private spec, a malicious or compromised spec can reference an attacker-controlled URL and cause the generator to send those credentials to it. This exfiltrates high-value secrets such as bearer tokens, personal access tokens, or API keys to the attacker. The fix forwards the authorization token only to same-origin remote URLs and blocks cross-origin credential forwarding.