TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

@typespec/spector registers an unauthenticated POST /.admin/stop HTTP route that triggers process.exit(0), shutting down the server immediately. The server listens on 0.0.0.0 by default, exposing this endpoint to any network client. There is no authentication, authorization token, Origin header check, or IP allowlist protecting this critical function. The vulnerability is a Missing Authentication for Critical Function (CWE-306) and affects version 0.1.0-alpha.27. The attack chain involves sending a single unauthenticated POST request to the exposed endpoint, causing a denial of service by stopping the server process.

An unauthenticated remote attacker with network access to the server port can cause a complete denial of service by shutting down the mock server process with a single HTTP POST request. This disrupts development or CI/CD pipelines relying on the server, especially in environments where the port is exposed to untrusted networks. The default binding to 0.0.0.0 and lack of authentication means there is no built-in protection, increasing the risk of exploitation in shared or cloud environments.

A patch is available for this vulnerability. Users should update to a fixed version of @typespec/spector when released. Until patched, operators must restrict network access to the server port using external firewall rules or network segmentation to prevent untrusted clients from reaching the /.admin/stop endpoint. The vendor advisory or repository should be monitored for official fixes and updates.