mcp-from-openapi versions between 2.5.0 and before 2.9.0 contain a credential exposure flaw. When an HTTP request is redirected across origins, the safeFetch implementation blindly forwards Authorization and Cookie headers to the new location. An attacker can exploit this by controlling a spec host or using an open redirect to redirect outgoing requests to an attacker-controlled domain, thereby capturing bearer tokens or session cookies.

Agentfront MCP‑From‑OpenAPI is affected. All product releases from 2.5.0 up through 2.8.x are vulnerable. The issue was fixed in the 2.9.0 release, which removes the unsafe forwarding behavior.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires control over the spec host or an open redirect and the use of a browser that performs the cross‑origin redirect via safeFetch. While the conditions are not trivial, the ability to steal bearer tokens or cookies makes this a real threat to authenticated sessions.