CVE-2026-54660 in swagger-typescript-api
Summary
by MITRE • 07/29/2026
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in swagger-typescript-api affects versions prior to 13.12.2 where the src/resolved-swagger-schema.ts module contains a critical security flaw in how it handles remote schema resolution. The issue manifests when the getRemoteRequestHeaders function processes authorization tokens and forwards them indiscriminately to all URLs fetched during the fetchRemoteSchemaDocument operation, particularly during warmUpRemoteSchemasCache execution which resolves external $ref references. This behavior creates an unintended information disclosure channel where attacker-controlled OpenAPI specifications can potentially exfiltrate sensitive bearer tokens to arbitrary cross-origin endpoints.
The technical flaw represents a classic case of insecure remote resource handling that violates fundamental security principles of least privilege and proper access control. When the library processes OpenAPI specifications containing external $ref references, it automatically includes any authorization token provided via command-line arguments or environment variables in HTTP requests to resolve these remote references. This occurs regardless of whether the target endpoint is legitimate or controlled by an attacker, creating a vector for credential theft and unauthorized data access. The vulnerability specifically affects the warmUpRemoteSchemasCache function which performs background resolution of external references during schema processing.
This security issue has significant operational impact on development environments and continuous integration pipelines where swagger-typescript-api is commonly used to generate API client code. Developers and CI systems may unknowingly execute malicious OpenAPI specifications that contain crafted $ref entries pointing to attacker-controlled endpoints, leading to unauthorized token exfiltration. The cross-origin nature of the attack means that tokens could be sent to any domain, potentially enabling attackers to intercept sensitive authentication information including personal access tokens, API keys, or service account credentials used in development and deployment workflows.
The vulnerability aligns with CWE-201, Information Exposure Through Sent Data, and specifically relates to improper handling of authorization headers during remote resource resolution. It also maps to ATT&CK technique T1566.001 for credential access through malicious document delivery, and T1071.004 for application layer protocol usage in data exfiltration. Organizations using this library should immediately update to version 13.12.2 or later where the fix properly sanitizes authorization token handling during remote schema resolution. The mitigation strategy involves implementing proper access control checks before forwarding authentication information, validating target endpoints against a whitelist, and ensuring that authorization tokens are only forwarded to trusted domains as part of the remote reference resolution process.