The vulnerability arises from multiple functions in @haxtheweb/open-apis (versions >=9.0.1 <26.0.0) that validate hostnames by substring matching rather than exact matching. This flaw allows an attacker to craft hostnames that include the allowed substring but redirect authorization to an attacker-controlled endpoint, thereby capturing authentication data. The problem is categorized under CWE-183 (Permissive List of Allowed Inputs) and CWE-918 (Server-Side Request Forgery). The CVSS 4.0 base score is 8.7, indicating high severity. There is no vendor advisory or patch link provided, but version 26.0.0 is stated to fix the issue.

An attacker can exploit the permissive hostname validation to redirect basic authorization credentials to an attacker-controlled endpoint, potentially leading to credential theft and unauthorized access. This compromises the confidentiality of authentication data in affected versions of @haxtheweb/open-apis prior to 26.0.0.

Upgrade to version 26.0.0 or later of @haxtheweb/open-apis, where the hostname validation issue is fixed. No other official remediation or temporary fix is documented. Patch status is not explicitly confirmed by a vendor advisory, but the version 26.0.0 release is identified as the fix.