The vulnerability exists in the cors function of the src/server.ts file within the Token Endpoint component of ericc-ch copilot-api versions 0.1 through 0.7.0. This flaw results in a permissive cross-origin resource sharing (CORS) policy that accepts requests from untrusted domains, potentially enabling unauthorized cross-domain interactions. The vulnerability is remotely exploitable without privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, and no required privileges or user interaction. No official fix or patch has been documented, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows remote attackers to bypass same-origin policy restrictions by exploiting a permissive CORS configuration, potentially leading to unauthorized access or manipulation of resources via cross-domain requests. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known exploits in the wild have been reported, but a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been documented, users should monitor for vendor updates addressing this issue. Until a patch is available, consider restricting CORS policies manually to trusted domains or disabling CORS if feasible to reduce exposure.