CVE-2026-6662: Open CORS Policy in copilot-api Exposes Token Endpoint
The National Vulnerability Database (NVD) has disclosed CVE-2026-6662, a critical vulnerability impacting ericc-ch copilot-api versions up to 0.7.0. The flaw resides in the CORS (Cross-Origin Resource Sharing) implementation within the Token Endpoint’s src/server.ts file. Attackers can exploit this weakness to establish permissive cross-domain policies, allowing them to interact with untrusted domains remotely. With the exploit already public, this presents an immediate risk to organizations utilizing this component.
What This Means For You
- If your organization uses ericc-ch copilot-api, you must update to a version beyond 0.7.0 immediately. This vulnerability allows remote attackers to bypass domain restrictions, potentially leading to unauthorized access or data exfiltration through the token endpoint. Audit your API endpoints for any unusual cross-domain requests.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-6662: Open CORS Policy in copilot-api Token Endpoint
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6662 | Misconfiguration | ericc-ch copilot-api up to 0.7.0 |
| CVE-2026-6662 | Misconfiguration | Token Endpoint component |
| CVE-2026-6662 | Misconfiguration | src/server.ts::cors function |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 20, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-41389 — OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce
CVE-2026-41389 — OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can...
CVE-2026-39112 — Cross Site Scripting vulnerability in Apartment Visitors
CVE-2026-39112 — Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname parameter of visitors-form.php. An authenticated attacker...
Unauthenticated SQLi in Apartment Visitors Management System
CVE-2026-39111 — SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php)....