The vulnerability resides in ericc‑ch's copilot‑api, affecting the Header Handler component up to version 0.7.0. A flaw in the /token endpoint allows manipulation of the Host HTTP header, causing the service to perform reverse DNS resolution on the supplied host. Because the API does not validate or restrict this header, an attacker can supply a crafted host value that maps back to the target system, potentially bypassing authentication checks or executing unintended paths (inferred). This weakness is classified as CWE‑350, indicating insufficient authentication or authorization controls.

Affected systems include any installations of ericc‑ch copilot‑api running version 0.7.0 or earlier. The specific location is the Header Handler's handling of the /token route where Host header validation is performed. No other vendors or products are listed as impacted.

The vulnerability carries a CVSS score of 5.3, placing it in the moderate severity range. The EPSS score is less than 1 %, suggesting that, at present, the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack can be conducted remotely simply by sending a crafted HTTP request to the service, which publicly disclosed the issue. While the immediate risk is moderate, the lack of official vendor remediation means that organizations should treat this as a potential vector for unauthorized access (inferred) until a patch is released.