CVE-2026-54660 Details
Description
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2.
A vulnerability in swagger-typescript-api prior to version 13.12.2 allows for the exfiltration of authorization tokens through cross-origin requests. When the generator fetches external references from OpenAPI specifications, it forwards the '--authorizationToken' to every URL without validating the origin. This flaw can be exploited by a malicious OpenAPI spec to capture sensitive tokens, such as GitHub Personal Access Tokens, OAuth bearers, or AWS API keys, and send them to an attacker-controlled endpoint.
Users can update to swagger-typescript-api version 13.12.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-h754-fxp7-88wx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de | [email protected] | Source CodeVendor |
| https://github.com/acacode/swagger-typescript-api/pull/1779 | [email protected] | Issue TrackingVendor |
| https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 | [email protected] | Release NotesVendor |
| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-h754-fxp7-88wx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| acacode swagger-typescript-api | <= 13.12.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |