A flaw in the swagger-typescript-api library allows an attacker to supply a malicious OpenAPI specification that causes the generator to forward the developer or CI bearer token to every external $ref URL it retrieves. The vulnerability is rooted in the getRemoteRequestHeaders function, which propagates the "--authorizationToken" flag during schema warm‑up. The leak of authentication credentials falls under information disclosure (CWE‑200, CWE‑201, CWE‑522) and is amplified by insecure cross‑domain reference resolution (CWE‑918). The documentation states that the token can be exfiltrated to a cross‑origin endpoint; it is inferred that an attacker who obtains the token could subsequently use it to call protected APIs or services on behalf of the user.

The library is provided by acacode as the swagger‑typescript‑api package, which generates Fetch or Axios clients from OpenAPI specifications. Versions older than v13.12.2 are affected; the issue was fixed in release v13.12.2 and later.

The CVSS score of 7.4 classifies the vulnerability as high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation as of now. The flaw is not listed in CISA’s KEV catalog. Exploitability requires the runtime that uses swagger‑typescript‑api to load a malicious specification, which is inferred to typically occur in a compromised CI/CD pipeline or on a local development machine that accepts untrusted specs. In such scenarios, the bearer token is unintentionally sent to an attacker‑controlled endpoint via the external $ref resolution flow, exposing credentials and potentially enabling further action.