CVE-2026-6662

HIGH

ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy

Title source: cna

Description

A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src/server.ts of the component Token Endpoint. Performing a manipulation results in permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

References (4)

[Vdb Entry, Technical Description] https://vuldb.com/vuln/358300

[Signature, Permissions Required] https://vuldb.com/vuln/358300/cti

[Third Party Advisory] https://vuldb.com/submit/794601

[Exploit] https://github.com/August829/CVEP/issues/31

Scores

CVSS v3 7.3

EPSS 0.0002

EPSS Percentile 4.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-346 CWE-942

Status published

Products (7)

ericc-ch/copilot-api 0.1

ericc-ch/copilot-api 0.2

ericc-ch/copilot-api 0.3

ericc-ch/copilot-api 0.4

ericc-ch/copilot-api 0.5

ericc-ch/copilot-api 0.6

ericc-ch/copilot-api 0.7.0

Published Apr 20, 2026

Tracked Since Apr 20, 2026