swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHe…

CVE-2026-54660 affects swagger-typescript-api, a tool that generates API clients for Fetch or Axios from OpenAPI specifications. Prior to version 13.12.2, the function getRemoteRequestHeaders in src/resolved-swagger-schema.ts forwards the --authorizationToken to every URL fetched by fetchRemoteSchemaDocument. When warmUpRemoteSchemasCache resolves external $ref URLs, an attacker-controlled OpenAPI specification can exploit this behavior to exfiltrate developer or CI/CD pipeline bearer tokens to a cross-origin endpoint. This represents a supply chain risk as developers or automated CI systems processing malicious OpenAPI specs could have their credentials stolen. The vulnerability is fixed in version 13.12.2 of swagger-typescript-api. Users are advised to upgrade immediately to mitigate the risk of token exfiltration.