The vulnerability exists in the cors function of src/server.ts in the Token Endpoint of ericc-ch copilot-api up to 0.7.0. A crafted request can manipulate the CORS configuration, causing the server to allow any origin. This permits cross-origin requests from malicious domains, enabling attackers to retrieve or submit protected data via the token endpoint. The flaw is identified as CWE-346 and CWE-942, highlighting improper validation and insecure direct resource references. The result is potential confidentiality compromise and exploitation of authentication mechanisms.

Impact product is ericc-ch:copilot-api, version 0.7.0 and earlier. The vulnerability has been identified in the source file src/server.ts. No other product versions mentioned. Therefore any deployment of ericc-ch copilot-api up to 0.7.0 is affected.

The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA KeV. The attack can be performed remotely by sending a request to the token endpoint with a crafted Origin header or by exploiting the permissive CORS configuration. As the exploit is public, an attacker can use this to bypass same-origin policy and access sensitive data.