CVE-2026-6662

Name of the Vulnerable Software and Affected Versions ericc-ch copilot-api versions prior to 0.7.1

Description A flaw exists in the Token Endpoint component within the cors() function of the src/server.ts file. A manipulation of this function allows for a permissive cross-domain policy with untrusted domains, which can be triggered remotely.

Recommendations Update ericc-ch copilot-api to a version later than 0.7.0. As a temporary workaround, restrict access to the cors() function in the src/server.ts file to minimize the risk of exploitation.