The vulnerability arises from improper hostname validation in multiple functions of @haxtheweb/open-apis versions >=9.0.1 and <26.0.0. These functions use substring-only matching to determine if basic authorization credentials should be sent to a hostname. Because substring matching is insufficiently strict, an attacker can craft a hostname that includes a valid substring but points to an attacker-controlled endpoint, thereby capturing authentication credentials. This is a CWE-183 (Permissive List of Allowed Inputs) and CWE-918 (Server-Side Request Forgery) related issue. The problem is resolved in version 26.0.0 of the package.

An attacker can exploit the permissive hostname validation to redirect authentication credentials to attacker-controlled endpoints, potentially leading to credential theft. This compromises the confidentiality of basic authorization credentials used by the application. The vulnerability has a CVSS 4.0 score of 8.7, indicating a high impact on affected systems. There are no reports of active exploitation in the wild at this time.

Upgrade @haxtheweb/open-apis to version 26.0.0 or later, where the hostname validation issue is fixed. Since the vulnerability is resolved in this version, applying this official fix is the recommended remediation. Patch status is not explicitly stated beyond the version fix; therefore, confirm with the vendor advisory for any additional guidance.