This vulnerability in ericc-ch copilot-api (up to version 0.7.0) arises from reliance on reverse DNS resolution within an unspecified function of the /token endpoint's Header Handler component. An attacker can manipulate the Host argument remotely to trigger this behavior. The vulnerability was publicly disclosed, but no official remediation or patch has been provided by the vendor. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality and integrity.

An attacker can remotely manipulate the Host argument to exploit the reliance on reverse DNS resolution, potentially causing incorrect or malicious DNS-based decisions by the application. The exact impact on confidentiality, integrity, or availability is limited as per the CVSS score, but could lead to security logic errors or misattribution of client identity. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level controls to restrict access to the vulnerable endpoint and monitor for suspicious Host header manipulations. Avoid relying on reverse DNS resolution for security decisions until a patch or official mitigation is available.