Multiple functions in @haxtheweb/open-apis before version 26.0.0 validate hostnames by checking for a substring match, and they send HTTP basic authentication credentials to any matched host. An attacker can supply an endpoint containing the matched substring, causing the server to forward stored credentials to the attacker's chosen host. This flaw allows the attacker to capture authentication tokens, which can then be used to impersonate users or access restricted resources.

The vulnerability affects the HAX CMS project’s @haxtheweb/open-apis package, specifically versions starting at 9.0.1 up through 25.9.9. The issue is mitigated in version 26.0.0. All deployments of the open-apis component that are within the affected range are at risk.

The CVSS score of 8.7 indicates a high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker making a crafted request to the vulnerable API; the flaw can be exploited without additional user interaction. An attacker can gain credentials with the same authorization level used by the server, potentially compromising user accounts or administrative functions.